The WP Photo Album Plus WordPress plugin prior to version 9.2.07.002 does not enforce capability or nonce verification on one of its public REST API endpoints. This security oversight permits unauthenticated attackers to delete album export ZIP archive files generated and stored by the plugin. The issue is categorized as CWE-73, indicating external control of file names or paths, which can lead to unauthorized deletion of files. No official patch or remediation level has been indicated in the available data.

An unauthenticated attacker can delete album export ZIP archives stored by the plugin, resulting in potential loss of user-generated content or exported data. There is no indication of confidentiality or availability impact beyond the deletion of these files. The vulnerability does not require user interaction or privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST endpoint if possible or implement additional access controls at the web server or application firewall level to prevent unauthorized deletion requests.