The WP Photo Album Plus plugin fails to verify the origin or security token for the comment‑deletion request, allowing attackers to delete photo comments by tricking a logged‑in moderator into loading a crafted page. This flaw is a classic CSRF vulnerability (CWE‑352) that can compromise the integrity of user‑generated content, erasing comments and damaging trust on the site.

The vulnerability affects the WordPress plugin WP Photo Album Plus on all installations using a version earlier than 9.3.04.004. Any site where a user has comment‑moderation rights is at risk, regardless of other security configurations.

Exploitation requires a victim with moderation privileges to visit a malicious link, a relatively low‑effort attack that can be performed over the Internet. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog, indicating it has not yet been widely exploited. Nevertheless, the impact on data integrity and the low barrier to attack make this a moderate‑to‑high risk for sites that rely on the affected plugin.