Command Injection Vulnerability in WP Photo Album Plus Plugin

CVE-2026-92115

What is CVE-2026-92115?

The WP Photo Album Plus plugin is susceptible to command injection vulnerabilities due to improper handling of the 'value' parameter within the 'update-photo' AJAX action. This weakness allows authenticated users with the 'wppa_upload' capability to inject arbitrary operating-system commands into an ImageMagick command string via the 'wppa_image_magick_a()' function. Insufficient shell escaping leads to potential remote code execution, especially for systems where ImageMagick is enabled. Furthermore, the 'wppa_decode()' function fails to properly sanitize percent-encoded shell metacharacters, allowing crafted payloads to circumvent protections. As a result, this vulnerability could permit advanced attackers to gain control over the server environment, thereby exploiting the system beyond its intended security boundaries.

References