A critical information exposure vulnerability in the WP Photo Album Plus plugin permits unauthenticated attackers to read sensitive configuration data from the WordPress database.

The plugin fails to implement necessary capability or nonce checks on a public endpoint, allowing an unauthenticated attacker to supply arbitrary option names and read the values of sensitive autoloaded options.

The ability for unauthenticated parties to extract configuration data may lead to the exposure of sensitive credentials, API keys, or internal system paths stored in the WordPress options table. While the plugin provider indicates a lower CVSS score of 5.3, the potential for unauthorized data access presents a significant risk to the confidentiality of the entire WordPress environment, warranting immediate attention.

Immediate Action: Update the WP Photo Album Plus plugin to version 9.2.07.002 or later to apply the necessary capability and nonce validation.

Proactive Monitoring: Review web server access logs for anomalous requests targeting plugin endpoints that involve suspicious option name parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable plugin endpoint until the update can be applied.

Public Exploit Available: Unknown

Given the ease of exploitation for this vulnerability, administrators should prioritize updating the WP Photo Album Plus plugin immediately. Failure to patch allows unauthenticated attackers to potentially harvest sensitive configuration details that could facilitate further compromise of the WordPress site.