Product
Authenticated users with specific plugin privileges can achieve remote code execution in WP Photo Album Plus via command injection in the update-photo AJAX action.