CVE-2026-18048

The CVSS score on CVE-2026-18048 doesn't tell the whole story. This is a path traversal vulnerability in a WordPress photo album plugin that allows unauthenticated deletion of ZIP archives anywhere on the filesystem accessible to the web server process—including directories outside the web root like /home/user/backups/ or /var/www/backups/. The EPSS score of 0.00243 is deceptively low, but that reflects opportunistic exploitation probability, not strategic severity. The real danger is what happens when an attacker chains this with any upload or write capability: they can destroy backup archives before deploying ransomware, eliminate forensic evidence, or burn recovery paths that defenders depend on to recover from catastrophic compromises. The blast radius extends beyond the compromised site. On shared hosting infrastructure where backup directories are centralized, destroying /var/www/backups/ eliminates recovery options for every tenant on that node—not just the initially targeted site. This collapses the assumption that storage outside the web root is inherently safe. Defenders should audit their backup storage isolation, verify that the web server process lacks write permissions to backup directories, and treat any plugin with ZIP processing capabilities as a high-priority review target. The orphaned filesystem operation that makes this possible likely survived deprecation—an unmaintained code path that remained executable years after its parent function was supposedly disabled. That's the pattern: deprecation is not eradication. Prioritize plugins handling uploads or archives for removal or isolation, because the upload-to-delete-to-exploit chain is exactly how sophisticated attackers now operate.

Reviewed through automated stages and approved by a human before publication.