CVE-2026-87909

Overview

The WP Photo Album Plus plugin for WordPress contains a remote code execution vulnerability in the wppa_image_magick function. Authenticated attackers with subscriber-level access or higher can exploit insufficient filename sanitization during multipart uploads. This allows execution of arbitrary code on the underlying server via improper use of shell execution functions.

Description

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

Impact

An authenticated attacker with low privileges (subscriber level) can achieve complete system compromise through remote code execution. This impacts the confidentiality, integrity, and availability of the hosting server and WordPress application. Defenders face risks of unauthorized data access, malware deployment, and site takeover.

Remediation

Update the WP Photo Album Plus plugin to the latest patched version provided by the vendor. Restrict administrative and subscriber-level user registrations to trusted individuals. Implement strict file upload monitoring and review web application firewall (WAF) rules to detect suspicious image processing payloads.

Risk context

Rated as a high severity vulnerability with a CVSS v3 score of 7.5 and a low EPSS score of 0.00525. While exploitation requires low-privileged authentication, the potential for remote code execution demands prompt attention and patching.

Affected products

• WP Photo Album Plus plugin for WordPress