The vulnerability lies in the WP Photo Album Plus WordPress plugin prior to 9.2.07.002. A public endpoint action named gettogo fails to enforce capability or nonce checks and constructs an option name from a client‑supplied value, allowing an unauthenticated user to read any autoloaded option whose name ends with a matching suffix. The result is that sensitive configuration data can be exposed over the network without authorization.

The affected product is the WP Photo Album Plus WordPress plugin. Precise version coverage is limited to releases before 9.2.07.002, but no detailed version list is provided in the official data.

Because the exploit requires only a standard HTTP request to a public endpoint and does not rely on any prior user authentication, the attack vector is unauthenticated web access. The CVSS score of 7.5 and the EPSS score of <1% indicate a high-severity vulnerability with a low likelihood of exploitation, yet still significant enough to pose a considerable threat. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the endpoint to retrieve arbitrary option values, potentially exposing configuration data stored in the WordPress options table. The lack of mitigating controls suggests that vulnerable installations could easily suffer data leakage without any additional attacker effort.