An unauthenticated path traversal vulnerability in WP Photo Album Plus allows attackers to delete arbitrary ZIP archives, risking significant site data loss.

The plugin fails to validate user-controlled file paths within its public endpoint actions and lacks authorization checks. This allows unauthenticated attackers to perform path traversal and delete arbitrary ZIP files located on the server filesystem.

The CVSS score of 7.5 highlights a high-risk scenario where the integrity and availability of the server are at stake. By deleting critical ZIP archives, including backups or core site components, an attacker can cause immediate service disruption and data loss, potentially rendering the site non-functional.

Immediate Action: Update the WP Photo Album Plus plugin to version 9.2.07.002 immediately.

Proactive Monitoring: Monitor server file system activity logs for unauthorized file deletion events, particularly those targeting ZIP archives.

Compensating Controls: Use a Web Application Firewall to restrict access to the vulnerable public endpoints and block path traversal patterns (e.g., ../).

Public Exploit Available: No

Given that this vulnerability allows unauthenticated file deletion, it should be treated with high urgency. Administrators must update the plugin to version 9.2.07.002 to protect the server filesystem from unauthorized manipulation.