Description
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The export-table endpoint lacks a nonce check, meaning this vulnerability can also be triggered via CSRF by tricking an authenticated administrator into visiting a malicious page.
Published: 2026-07-29
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WP Photo Album Plus plugin for WordPress allows authenticated administrators to inject arbitrary SQL via the 'table' parameter due to insufficient escaping. This flaw enables read‑only access to the database and potentially further manipulations, aligning with CWE‑89.

Affected Systems

The vulnerability affects the WP Photo Album Plus plugin, versions 9.2.04.002 and earlier, installed within WordPress sites.

Risk and Exploitability

The CVSS score of 4.9 indicates moderate risk while the EPSS score of less than 1% suggests a low probability of exploitation. Only users with administrator access can exploit the flaw, and the lack of nonce on the export‑table endpoint also allows a CSRF attack that can trigger the injection when an administrator clicks a malicious link. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 3, 2026 at 13:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the WP Photo Album Plus plugin to the latest released version that corrects the 'table' parameter handling.
  • Add a nonce check to the export‑table endpoint or disable the endpoint until a patch is applied to eliminate CSRF exposure.
  • Apply input validation or sanitization to the 'table' parameter, such as rejecting unexpected values or using a whitelist, to prevent SQL injection.

Generated by OpenCVE AI on August 3, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Opajaap
Opajaap wp Photo Album Plus
Wordpress
Wordpress wordpress
Vendors & Products Opajaap
Opajaap wp Photo Album Plus
Wordpress
Wordpress wordpress

Wed, 29 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Description The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The export-table endpoint lacks a nonce check, meaning this vulnerability can also be triggered via CSRF by tricking an authenticated administrator into visiting a malicious page.
Title WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Opajaap Wp Photo Album Plus
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-29T15:05:33.069Z

Reserved: 2026-07-09T20:23:15.993Z

Link: CVE-2026-15344

cve-icon Vulnrichment

Updated: 2026-07-29T15:05:10.344Z

cve-icon NVD

Status : Deferred

Published: 2026-07-29T04:17:13.313

Modified: 2026-07-30T14:01:30.413

Link: CVE-2026-15344

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T14:00:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')