A REST endpoint named delexportzips in the WP Photo Album Plus WordPress plugin does not perform any capability or nonce verification. As a result, any user, regardless of authentication status, can invoke this action and delete the ZIP files that the plugin creates to export album data. The primary consequence is loss of these exported archives, constituting an availability violation that could remove backup copies of user content. The likely attack vector is a straightforward HTTP request to the publicly exposed endpoint; the description indicates that no authenticated session or token is required, so the vulnerability is effectively unauthenticated.

It affects the WordPress plugin WP Photo Album Plus for all releases earlier than version 9.2.07.002. Administrators should verify that their plugin is at or above the patched version to ensure the delexportzips action is protected or removed.

The flaw requires no special privileges and can be exploited by sending a simple HTTP request to the exposed REST endpoint. The EPSS score is <1%, indicating a very low but non-zero likelihood of exploitation. The CVSS score of 5.3 reflects moderate severity. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the lack of authentication checks makes the impact significant in terms of availability, but the moderate CVSS score suggests that the overall threat is moderate rather than high.