CVE-2026-92115
Received Received - Intake

Authenticated Command Injection in WP Photo Album Plus Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-92115
EUVD
EUVD-2026-102802

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opajaap WP Photo Album Plus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in the WP Photo Album Plus WordPress plugin affecting versions up to 9.3.02.002. Attackers with the plugin-defined 'wppa_upload' capability can inject malicious shell commands via the 'value' parameter in the 'update-photo' AJAX action. The flaw occurs because user input is directly concatenated into an ImageMagick command without proper escaping, and a decoding function restores percent-encoded shell metacharacters, allowing command execution as the web server user.

Detection Guidance

Check for unauthorized ImageMagick command execution in server logs, particularly for the wppa_image_magick_a() function. Look for suspicious AJAX requests to update-photo with encoded shell metacharacters. Verify if the wppa_upload capability is assigned to non-admin WordPress users.

Impact Analysis

An attacker could exploit this to execute arbitrary operating-system commands on your server, potentially gaining full control over your WordPress site and underlying server. This could lead to data theft, website defacement, malware installation, or use of your server for further attacks. The risk is higher if ImageMagick is enabled and if lower-privileged WordPress users have been granted the 'wppa_upload' capability.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). A successful exploit may result in exposure of sensitive user data, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Immediately update the WP Photo Album Plus plugin to version 9.3.02.003 or later. Remove the wppa_upload capability from non-admin users if assigned. Disable ImageMagick on the server if not required. Monitor server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart