Remote Code Execution in WP Photo Album Plus Plugin

The WP Photo Album Plus plugin for WordPress is susceptible to a remote code execution vulnerability identified as CVE-2026-87909. The flaw exists within the wppa_image_magick function, which fails to correctly sanitize user-provided multipart upload filenames before passing them to the ImageMagick utility via the PHP exec() function.

Although the plugin employs escapeshellcmd() on the constructed command string, this mitigation is insufficient to prevent argument injection. Because spaces remain unescaped, an attacker can append malicious arguments to the ImageMagick command line. Furthermore, the file path handling logic bypasses database-layer sanitization, allowing the use of arbitrary physical paths for execution. Authenticated users with subscriber-level privileges or higher can leverage this flaw to run malicious code on the hosting server, potentially leading to full server compromise. The issue affects all versions of the plugin, necessitating immediate review and application of vendor-provided security patches or disabling the plugin until a fix is deployed.

Impact

Successful exploitation allows authenticated attackers to gain remote code execution with the permissions of the web server user. This could lead to sensitive data theft, complete site defacement, or lateral movement within the hosting environment. As this affects any WordPress site running this plugin, the attack surface is broad, and given the low privilege requirement (subscriber), the barrier to entry is minimal.

Recommendation

• Identify all WordPress installations utilizing the WP Photo Album Plus plugin by scanning for active plugins in the administrative dashboard or checking filesystem plugin directories.
• Review web server access logs for anomalous POST requests directed to the plugin's upload endpoints, specifically monitoring for unusual filename parameters or shell metacharacters.
• Disable the WP Photo Album Plus plugin immediately if a security update from the developer is not yet available.
• Audit server-side execution logs for processes spawned by the web server user (e.g., www-data) that were initiated by PHP, specifically those involving ImageMagick binaries (e.g., convert, mogrify).