Description
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.
Published: 2026-10-16
Score: 8.8 High
EPSS: 1.4% Low
KEV: No
Impact: Remote Code Execution via Authenticated Command Injection
Action: Immediate Patch
AI Analysis

Impact

The plugin contains a command injection flaw in the update‑photo AJAX handler. An attacker with the wppa_upload capability can send a specially crafted value parameter that bypasses shell escaping and is concatenated directly into an ImageMagick command executed with exec(). The plugin decodes percent‑encoded shell characters, enabling injection that runs OS commands as the web‑server user. This results in full remote code execution for the host system when the attacker is authenticated within the WordPress site.

Affected Systems

Any WordPress site running the WP Photo Album Plus plugin with a version 9.3.02.002 or earlier is affected. The vulnerability is present in all releases up to and including 9.3.02.002. The plugin’s wppa_upload capability can be granted to roles beyond administrators, expanding the set of users who can exploit the flaw.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. An EPSS score of 1% suggests a low but non‑zero likelihood of exploitation. The plugin’s capability model and reliance on ImageMagick mean that sites with the wppa_upload capability enabled to non‑administrator roles and ImageMagick support are prime targets. The flaw is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 16, 2026 at 17:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WP Photo Album Plus plugin to version 9.3.02.003 or later
  • Restrict the wppa_upload capability to administrators only, removing it from lower‑privileged roles
  • Disable ImageMagick support or remove the wppa_image_magick_a() function if ImageMagick is not required
  • As a temporary measure, block the update‑photo AJAX action or isolate exec system calls

Generated by OpenCVE AI on October 16, 2026 at 17:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Opajaap
Opajaap wp Photo Album Plus
Wordpress-extensions
Wordpress-extensions wp Photo Album Plus
Vendors & Products Opajaap
Opajaap wp Photo Album Plus
Wordpress-extensions
Wordpress-extensions wp Photo Album Plus

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.
Title WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
Weaknesses CWE-77
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Opajaap Wp Photo Album Plus
Wordpress-extensions Wp Photo Album Plus
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T15:09:37.836Z

Reserved: 2026-09-15T15:44:49.706Z

Link: CVE-2026-92115

cve-icon Vulnrichment

Updated: 2026-10-16T14:59:37.904Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T07:17:13.907

Modified: 2026-10-16T15:17:35.193

Link: CVE-2026-92115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T11:15:14Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')