CVE-2026-18048: WP Photo Album Plus Path Traversal Flaw

CVE-2026-18048 Overview

CVE-2026-18048 affects the WP Photo Album Plus WordPress plugin in versions before 9.2.07.002. The plugin exposes a public endpoint that builds a file path from a client-controlled value without validation or authorization checks. Unauthenticated attackers can abuse this behavior to delete arbitrary ZIP archives on the server, including files stored outside the web root. The flaw is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
Remote unauthenticated attackers can delete arbitrary ZIP archives on affected WordPress servers, causing data loss and potential disruption of backup or archive workflows.

Affected Products

WP Photo Album Plus WordPress plugin versions prior to 9.2.07.002

Discovery Timeline

2026-08-12 - CVE-2026-18048 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18048

Vulnerability Analysis

The vulnerability resides in a public endpoint action exposed by WP Photo Album Plus. The plugin accepts a client-supplied value and uses it to construct a file path targeted for deletion. Because the endpoint performs no authorization check and does not validate the supplied value, the resulting file operation runs with the privileges of the web server process.

An attacker can craft a request that traverses the file system and targets any ZIP archive readable and writable by the WordPress user. This includes files outside the web root, which broadens the scope beyond plugin-managed directories. The impact is limited to integrity loss on .zip files, consistent with the CVSS vector's I:H and C:N/A:N attributes.

Root Cause

The root cause is external control of a filename and path combined with a missing authorization check on a publicly reachable endpoint. The plugin trusts client input to identify the deletion target rather than resolving it against a server-side allowlist or the current user's owned resources.

Attack Vector

Exploitation requires only network access to the affected WordPress site. No authentication, user interaction, or elevated privileges are required. The attacker submits a request to the vulnerable public endpoint with a path parameter pointing at a target ZIP file. The plugin resolves the path and issues a delete operation without verifying either the caller's identity or the location of the file. See the WPScan Vulnerability Report for additional technical detail.

No verified public proof-of-concept code has been published at the time of this writing.

Detection Methods for CVE-2026-18048

Indicators of Compromise

Unexpected deletion of .zip archives on WordPress hosts, particularly backup archives or files outside wp-content/.
HTTP requests to WP Photo Album Plus public endpoints containing path traversal sequences such as ../ in parameters.
Web server access logs showing unauthenticated POST or GET requests to WPPA action handlers followed by filesystem changes.

Detection Strategies

Correlate WordPress access logs with filesystem audit events (auditd on Linux) for unlink operations on ZIP files initiated by the web server user.
Alert on any WPPA action parameters containing directory traversal characters or absolute paths.
Baseline the set of ZIP files expected under managed directories and alert on deletions outside that baseline.

Monitoring Recommendations

Enable file integrity monitoring on WordPress document roots and adjacent backup directories.
Ship web server and WordPress debug.log entries to a central log platform for retention and query.
Review WAF telemetry for repeated requests targeting WPPA endpoints from a single source.

How to Mitigate CVE-2026-18048

Immediate Actions Required

Upgrade the WP Photo Album Plus plugin to version 9.2.07.002 or later on all WordPress sites.
Audit filesystems for unexpected deletion of ZIP archives, including backups located outside the web root.
Restrict the WordPress process account so it cannot write to or delete files outside required directories.

Patch Information

The vendor addressed the issue in WP Photo Album Plus version 9.2.07.002. Administrators should update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Confirm the installed version in wp-admin after updating. Reference: WPScan Vulnerability Report.

Workarounds

If patching is not immediately possible, deactivate and remove the WP Photo Album Plus plugin.
Deploy a Web Application Firewall rule that blocks requests to the vulnerable WPPA action containing path traversal characters or absolute path prefixes.
Move sensitive ZIP backups off the WordPress host and revoke delete permissions for the web server user on archive storage locations.

bash

# Example WAF rule concept (ModSecurity) - block traversal in WPPA action parameters
SecRule ARGS_NAMES "@rx ^wppa-" "chain,phase:2,deny,status:403,id:1026180480,msg:'CVE-2026-18048 WPPA path traversal attempt'"
  SecRule ARGS "@rx (\.\./|^/|\.zip$)" "t:none,t:urlDecodeUni"