SQL Injection Vulnerability in WP Photo Album Plus Plugin for WordPress

CVE-2026-15344

What is CVE-2026-15344?

The WP Photo Album Plus plugin for WordPress contains a vulnerability that allows authenticated users with administrator-level access to execute arbitrary SQL queries. This occurs due to inadequate escaping of the user-supplied 'table' parameter within the SQL query, exposing the plugin to SQL Injection attacks. Furthermore, the export-table endpoint lacks a nonce check, enabling attackers to exploit this vulnerability via Cross-Site Request Forgery (CSRF), potentially leading to the extraction of sensitive database information by tricking an administrator into visiting a malicious site.

References