CVE-2026-110983 Details
Description
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WP Photo Album Plus WordPress plugin, affecting versions prior to 9.3.04.004. The vulnerability arises because the plugin does not properly verify the origin or security token for certain comment-management requests. This lack of validation allows attackers to delete photo comments by manipulating a logged-in user with comment-moderation rights into visiting a specially crafted page.
Users are advised to update the WP Photo Album Plus WordPress plugin to version 9.3.04.004 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| WP Photo Album Plus | < 9.3.04.004 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |