The WP Photo Album Plus plugin up to version 9.1.13.005 suffers from an unchecked input that permits blind SQL injection. This flaw allows a remote attacker to craft arbitrary SQL statements, potentially compromising the integrity and confidentiality of the WordPress database. The weakness is classified as CWE‑89.

Jacob N. Breetvelt’s WP Photo Album Plus for WordPress is affected. All releases from the earliest available configuration through 9.1.13.005 are vulnerable; versions 9.2.01.001 and later include the fix.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is not available, leaving the exploitation probability uncertain. Its status in CISA’s KEV catalog is not listed, indicating no known public exploit. The likely attack vector is remote via the WordPress front‑end or admin interface when the plugin is active, and the exploit requires trial‑and‑error unless the attacker can observe error feedback, as it is a blind injection.