Key points
- The flaw exists in all versions of the WP Photo Album Plus plugin up to and including version 9.3.02.002.
- Attackers need the plugin's specific wppa_upload capability to exploit the issue, which can be granted to non-admin roles.
- The vulnerability is rated 8.8 (High) on the CVSS scale and requires ImageMagick to be enabled on the server.
The WP Photo Album Plus plugin for WordPress contains a high-severity command injection flaw in every version released up to and including 9.3.02.002. According to the National Vulnerability Database record for CVE-2026-92115, this issue allows authenticated attackers to execute arbitrary operating-system commands. The vulnerability stems from insufficient shell escaping within the plugin's code, specifically in the wppa_image_magick_a() function.
In plain English
When a user with the correct permissions uploads or updates a photo, the plugin sends data to the server. The plugin fails to properly sanitize this data before passing it to the ImageMagick software. An attacker can craft a request that includes special characters designed to break out of the intended command. This allows the attacker to run their own commands on the server as the web-server user, potentially taking full control of the underlying system.
The background
The technical root cause involves the update-photo AJAX action and its value parameter. The plugin concatenates this parameter directly into an ImageMagick command string without using the escapeshellarg() function to escape dangerous characters. Furthermore, the wppa_decode() function actively restores percent-encoded shell metacharacters, such as converting %26 back to &. This behavior allows crafted payloads to survive initial sanitization checks and successfully inject commands into the execution context.
What changes now
Exploitation requires the attacker to hold the plugin-defined wppa_upload capability. While this is a plugin-level privilege, site administrators can grant it to lower-privileged WordPress roles through the plugin's Users settings. This capability broadens the pool of potential attackers beyond just site administrators. The vulnerability also requires that ImageMagick be enabled on the server for the command injection to succeed.
Who needs to act first
Site administrators should prioritize updating any server where the WP Photo Album Plus plugin is installed and ImageMagick is active. Teams usually begin by identifying all sites using this plugin and checking the current version against the vulnerable range. It is advisable to create a full backup of the site before making any changes. If an update is not immediately available, consider restricting the wppa_upload capability to only trusted administrators. Monitoring server logs for unexpected command executions can help detect potential exploitation attempts early.
What to do and how to stay safe: WP Photo Album Plus
- Check your WordPress dashboard to see if you are running WP Photo Album Plus version 9.3.02.002 or earlier.
- Review user roles to ensure only necessary accounts have the wppa_upload capability.
- Monitor server logs for unusual activity or command executions related to ImageMagick.
- Wait for the vendor to release an official update before applying any unofficial patches.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of WP Photo Album Plus are affected?
All versions up to and including 9.3.02.002 are vulnerable to this command injection flaw.
Do I need to be an administrator to exploit this?
No, any user with the wppa_upload capability can exploit it, which may include lower-privileged roles.
Is there a patch available yet?
The source material does not state whether a fix or update has been released for this vulnerability.
