[ CVE-2026-110983 · Published 29 Oct 2026 ]
Vulnerability in Unknown WP Photo Album Plus
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.