---
id: CVE-2026-110983
title: WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
summary: >-
  The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the
  origin or a security token for one of its comment-management requests,
  allowing attackers to delete photo comments by tricking a logged-in user who
  holds comm…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-352
product: WP Photo Album Plus
affected:
  - wp_photo_album_plus < 9.3.04.004
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T10:50:13.515960Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:06.731Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110983'
references:
  - url: 'https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/'
tags:
  - cve.org
epss: 0.00107
epssPercentile: 0.01155
ingestedAt: '2026-11-01T17:57:46.219Z'
---

## Overview

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.

## Affected

- `wp_photo_album_plus < 9.3.04.004`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.