{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wp-photo-album-plus--9.3.02.002/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wppa:wp_photo_album_plus:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-92115"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Photo Album Plus (\u003c= 9.3.02.002)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WP Photo Album Plus"],"content_html":"\u003cp\u003eThe WP Photo Album Plus plugin for WordPress contains an authenticated command injection vulnerability (CVE-2026-92115) affecting all versions up to and including 9.3.02.002. The flaw exists within the wppa_image_magick_a() function, which fails to apply proper shell escaping when processing the 'value' parameter of the 'update-photo' AJAX action. Instead of using escapeshellarg(), the application concatenates attacker-supplied input directly into an ImageMagick command string executed via the exec() function. Furthermore, the wppa_decode() utility restores percent-encoded shell metacharacters, allowing payloads to break out of the intended argument context. Any user assigned the wppa_upload capability, which can be granted to lower-privileged roles by site administrators, can exploit this flaw to run OS commands as the web-server process. This impact is contingent on the server having ImageMagick installed and active.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to gain remote code execution on the underlying server. Depending on server configuration, this may lead to full site compromise, lateral movement within the network, or unauthorized data access. The breadth of potential attackers is increased because the 'wppa_upload' capability is not restricted solely to WordPress administrators.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the WP Photo Album Plus plugin to a version released after 9.3.02.002 immediately to remediate CVE-2026-92115.\u003c/li\u003e\n\u003cli\u003eReview WordPress user roles and capabilities to identify accounts possessing the 'wppa_upload' privilege and revoke access for non-essential users.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests to the 'update-photo' AJAX action containing unusual characters such as semicolons, pipes, or ampersands in the 'value' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T08:25:39Z","date_published":"2026-10-16T08:25:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-photo-album-plus-rce/","summary":"Authenticated users with specific plugin privileges can achieve remote code execution in WP Photo Album Plus via command injection in the update-photo AJAX action.","title":"Authenticated Command Injection in WP Photo Album Plus","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-photo-album-plus-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Photo Album Plus (\u003c= 9.3.02.002)","version":"https://jsonfeed.org/version/1.1"}