Authenticated Command Injection in WP Photo Album Plus

The WP Photo Album Plus plugin for WordPress contains an authenticated command injection vulnerability (CVE-2026-92115) affecting all versions up to and including 9.3.02.002. The flaw exists within the wppa_image_magick_a() function, which fails to apply proper shell escaping when processing the 'value' parameter of the 'update-photo' AJAX action. Instead of using escapeshellarg(), the application concatenates attacker-supplied input directly into an ImageMagick command string executed via the exec() function. Furthermore, the wppa_decode() utility restores percent-encoded shell metacharacters, allowing payloads to break out of the intended argument context. Any user assigned the wppa_upload capability, which can be granted to lower-privileged roles by site administrators, can exploit this flaw to run OS commands as the web-server process. This impact is contingent on the server having ImageMagick installed and active.

Impact

Successful exploitation allows authenticated attackers to gain remote code execution on the underlying server. Depending on server configuration, this may lead to full site compromise, lateral movement within the network, or unauthorized data access. The breadth of potential attackers is increased because the 'wppa_upload' capability is not restricted solely to WordPress administrators.

Recommendation

• Update the WP Photo Album Plus plugin to a version released after 9.3.02.002 immediately to remediate CVE-2026-92115.
• Review WordPress user roles and capabilities to identify accounts possessing the 'wppa_upload' privilege and revoke access for non-essential users.
• Monitor web server logs for HTTP POST requests to the 'update-photo' AJAX action containing unusual characters such as semicolons, pipes, or ampersands in the 'value' parameter.