Remote Code Execution Vulnerability in WP Photo Album Plus Plugin for WordPress

CVE-2026-87909

What is CVE-2026-87909?

The WP Photo Album Plus plugin for WordPress has a vulnerability that allows remote code execution through the wppa_image_magick function. This weakness arises from inadequate sanitization of the multipart upload filename prior to its integration into an ImageMagick command string executed via the exec() function. As a result, authenticated attackers with subscriber privileges or higher can execute arbitrary code on the server. The current implementation employs escapeshellcmd() on the entire command, failing to appropriately quote individual arguments, which leaves space-separated arguments open to injection. Furthermore, while some filename sanitization occurs at the database layer, this process does not extend to the physical temporary file path used for ImageMagick, creating an exploitable gap.

References