Live › vulnerability › CVE-2026-110983
WP Photo Album Plus is a WordPress plugin whose comment-management request does not check the request origin or a security token. An attacker can trick a logged-in moderator into loading a crafted page, which deletes photo comments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running WP Photo Album Plus before 9.3.04.004 that have photo comments and logged-in users with comment-moderation rights. Sites without the plugin, or running a fixed version, are not affected. The attack needs a moderator to open a crafted link while logged in.
No product ranges from the sources yet.
9.3.04.004.9.3.04.004 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
This page as .md · .json · in your agent: get_signal("CVE-2026-110983")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.