WP Photo Album Plus (<= 9.3.02.002) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-photo-album-plus--9.3.02.002/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 08:25:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthenticated Command Injection in WP Photo Album Plushttps://feed.craftedsignal.io/briefs/2026-10-wp-photo-album-plus-rce/Fri, 16 Oct 2026 08:25:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wp-photo-album-plus-rce/Authenticated users with specific plugin privileges can achieve remote code execution in WP Photo Album Plus via command injection in the update-photo AJAX action.The WP Photo Album Plus plugin for WordPress contains an authenticated command injection vulnerability (CVE-2026-92115) affecting all versions up to and including 9.3.02.002. The flaw exists within the wppa_image_magick_a() function, which fails to apply proper shell escaping when processing the 'value' parameter of the 'update-photo' AJAX action. Instead of using escapeshellarg(), the application concatenates attacker-supplied input directly into an ImageMagick command string executed via the exec() function. Furthermore, the wppa_decode() utility restores percent-encoded shell metacharacters, allowing payloads to break out of the intended argument context. Any user assigned the wppa_upload capability, which can be granted to lower-privileged roles by site administrators, can exploit this flaw to run OS commands as the web-server process. This impact is contingent on the server having ImageMagick installed and active.

Impact

Successful exploitation allows authenticated attackers to gain remote code execution on the underlying server. Depending on server configuration, this may lead to full site compromise, lateral movement within the network, or unauthorized data access. The breadth of potential attackers is increased because the 'wppa_upload' capability is not restricted solely to WordPress administrators.

Recommendation

  • Update the WP Photo Album Plus plugin to a version released after 9.3.02.002 immediately to remediate CVE-2026-92115.
  • Review WordPress user roles and capabilities to identify accounts possessing the 'wppa_upload' privilege and revoke access for non-essential users.
  • Monitor web server logs for HTTP POST requests to the 'update-photo' AJAX action containing unusual characters such as semicolons, pipes, or ampersands in the 'value' parameter.
]]>highadvisory