CVE-2026-18049

This CVE allows reading any autoloaded WordPress option by guessing its name suffix. The vulnerability isn't in the information disclosure itself — it's in what's frequently stored in the autoload table and how the developer misunderstood WordPress's shared namespace model. WordPress's autoload table commonly contains high-value targets: third-party API keys from poorly-coded plugins, salted authentication cookies, multisite network credentials, and configuration data that shouldn't be exposed. The question for defenders isn't whether disclosure is bad — it's whether suffix-guessing reveals anything exploitable on your specific installation. Note that password reset tokens aren't the realistic escalation path here. Modern WordPress stores transients in the options table but with expiration mechanics, not as persistent autoloaded values. The more pressing concern is what the discussion calls 'entropy' — orphaned options from plugins you uninstalled years ago but whose database entries never got cleaned up. Those abandoned options often persist with valid API keys for services you no longer use, and they're invisible to anyone auditing your current stack. For WP Photo Album Plus specifically: check your autoload table for any option names that match the plugin's prefix pattern and contain tokens, keys, or credentials. More broadly, treat this CVE as evidence of a known bug family — dynamic option construction from user input — that's persisted since the 2016-2018 wave despite documented remediation patterns. The architectural fix isn't just input validation; it's using WordPress's built-in namespacing or separate tables. If you're auditing your plugins, look for any code that constructs option names dynamically from request parameters — that's the mutation marker that produces this entire vulnerability class.

Reviewed through automated stages and approved by a human before publication.