The WP Photo Album Plus WordPress plugin before 9.1.11.001 fails to sanitize the 'wppa-supersearch' parameter before incorporating it into a database query. This omission allows an unauthenticated user to inject arbitrary SQL statements, potentially compromising the confidentiality and integrity of the site’s database. The weakness is a classic SQL injection, classified as CWE‑89.

WordPress sites running WP Photo Album Plus plugin versions earlier than 9.1.11.001 are impacted. The vulnerability exists in all editions of the plugin where the vulnerable code path is active, regardless of user role.

Because the vulnerability is triggered by an unauthenticated HTTP request, any visitor can attempt an exploit without prior access or credentials. The EPSS score of <1% indicates a low probability of exploitation, yet the potential impact remains high due to the remote nature of the injection. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a standard crafted URL or form submission containing the malicious payload.