The WP Photo Album Plus plugin does not verify that the user making a front‑end upload is authorized to write to the target album. This flaw corresponds to CWE‑639, an authorization bypass through user‑controlled key. Consequently, any authenticated user, including those with the Subscriber role, can submit files to albums owned by other users or the administrator. The lack of authorization checks allows files, possibly of any type, to be stored on the web server. While the official description does not state that uploaded files will be executed, it is inferred that if an attacker uploads an executable script, it could be run by the web server under the same user context, potentially leading to remote code execution.

WordPress sites that employ the WP Photo Album Plus plugin with a version earlier than 9.2.09.002 and have the front‑end upload feature enabled. These sites allow any authenticated user to use the upload form. The vendor is unknown, and no specific response from a CNA is available.

The vulnerability has a CVSS score of 4.3, and its EPSS score is < 1 %. It is not listed in CISA’s KEV catalog. Exploitation requires a valid authenticated session; unauthenticated users cannot exploit the issue. The risk is that an attacker could place arbitrary files into any album, which may be used for defacement or, if executable files are accepted, for remote code execution. However, the possibility of RCE is an inference based on the fact that unrestricted file uploads could allow script execution; the official description does not verify that this outcome occurs.