CVE-2026-87909
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The WP Photo Album Plus plugin for WordPress (all versions) is vulnerable to remote code execution via the wppa_image_magick function. Insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command executed via exec(), with only escapeshellcmd() applied to the whole command. An authenticated attacker with subscriber-level access can execute code on the server.
Risk Assessment
An authenticated attacker with low privileges can execute arbitrary code on the server, leading to full system compromise.
Recommendation
Disable the WP Photo Album Plus plugin until a fix is available, as all versions are vulnerable.
Other vulnerabilities in WP Photo Album Plus
See all- CVE-2026-102386Medium
Subscriber Cross Site Scripting (XSS) vulnerability in WP Photo Album Plus versions up to 9.3.02.003. Allows an attacker to inject malicious script into the page.
- CVE-2026-10095Medium
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in versions up to and including 9.1.13.005 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.
- CVE-2026-39511Critical
There is an unauthenticated SQL injection vulnerability in WP Photo Album Plus versions up to 9.1.08.001.
- CVE-2026-110981High
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
- CVE-2026-96278High
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to and including 9.3.03.002 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when a user accesses an injected page, using a bypass that converts HTML entities back to live tags.
- CVE-2026-93774High
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus versions up to 9.3.02.002.
- CVE-2026-18579High
The WP Photo Album Plus plugin for WordPress (versions up to and including 9.2.08.003) is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter due to insufficient input sanitization and output escaping. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger, making the exploit fully reachable by unauthenticated callers.
- CVE-2026-18962Medium
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when processing a front-end upload. This allows any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the plugin's front-end user upload feature to be enabled, which is not the default.
- CVE-2026-18049High
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
- CVE-2026-18048High
The WP Photo Album Plus plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorization check. This allows unauthenticated attackers to delete arbitrary ZIP archives on the server, including those outside the web root.
Original NVD description (English source)
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS