CVE-2026-87909

Received Received - Intake

Remote Code Execution in WP Photo Album Plus Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-87909

Affected Vendors & Products

Vendor	Product	Version / Range
wp_photo_album_plus	wp_photo_album_plus	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The WP Photo Album Plus plugin for WordPress has a Remote Code Execution vulnerability in all versions due to insufficient sanitization of the multipart upload filename in the wppa_image_magick function. The vulnerability occurs because the filename is concatenated into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command. This allows authenticated attackers with subscriber-level access or higher to execute arbitrary code on the server.

Impact Analysis

This vulnerability allows attackers to execute code on your server if you use the WP Photo Album Plus plugin. Attackers with subscriber-level access or higher can exploit this to take control of your WordPress site, potentially stealing data, installing malware, or disrupting services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA compliance requirements. A successful exploit may result in exposure of sensitive user data, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update the WP Photo Album Plus plugin to the latest version if an update is available. If no update is available, consider disabling or removing the plugin until a patch is released. Review user roles and permissions to ensure only trusted users have subscriber-level access or higher.

Hi! I’m here to help you understand CVE-2026-87909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70