WP Photo Album Plus: Authenticated command injection via update-photo AJAX action
Summary
The WP Photo Album Plus WordPress plugin up to and including version 9.3.02.002 contains an OS command injection flaw in the update-photo AJAX action, reachable through the value parameter. An authenticated user holding the plugin's wppa_upload capability can inject shell commands that run as the web-server user, which can lead to full compromise of the underlying server. Exploitation requires ImageMagick to be enabled on the server.
Affected
- WP Photo Album Plus plugin for WordPress, versions 0 to and including 9.3.02.002
- Exploitation requires an account with the wppa_upload capability
- Exploitation requires ImageMagick to be enabled on the server
Fixed in
- Fixed version: not confirmed by a vendor advisory. 9.3.02.003 is likely the first fixed release (inferred from the CVE reference list), but this must be verified against the Wordfence advisory.
- Newer releases are available on wordpress.org; install the latest release.
Workaround
- Restrict the wppa_upload capability to only the users who absolutely need it.
- Disable ImageMagick in the plugin settings if it is not required (inferred, not vendor guidance).
- Web Application Firewall rules for command-injection patterns in AJAX parameters can be used as defence in depth; this is not a tested mitigation for this flaw.
Exploitation
- Exploited in the wild: unknown; not listed in CISA KEV according to a third-party tracker.
- Public proof of concept: none found in the consulted sources.
- EPSS: 0.01475 (low predicted exploitation probability).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory all WordPress sites running this plugin and record their versions.
- Update the plugin to the latest release from wordpress.org and confirm the fixed version against the Wordfence advisory.
- Review which users hold the wppa_upload capability and remove it where it is not needed.
- Check whether ImageMagick is enabled and disable it if it is not required.
- As a precaution, look for unexpected accounts, files or outbound connections on affected sites.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence advisory www.wordfence.com
- WordPress plugin download 9.3.02.003 downloads.wordpress.org
- WordPress plugin page wordpress.org
- Upstream changelog wppa.nl
- VulDB CVE-2026-92115 vuldb.com
- Strix CVE-2026-92115 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:06.
Original description (NVD)
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.
NVD references (7)
- https://downloads.wordpress.org/plugin/wp-photo-album-plus.9.3.02.003.zip
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2211
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2223
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2557
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-photo-files.php#L859
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-photo-files.php#L874
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fc663d68-ca52-4012-847f-09817c121890?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.