https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T16:58:13.853630+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-18048 CVE-2026-18048 — WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal 2026-10-04T16:58:13.866343+00:00

Affected: Unknown WP Photo Album Plus

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.