---
id: CVE-2026-87909
title: >-
  The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code
  Execution in all versions via the wppa_image_magick function
summary: >-
  The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code
  Execution in all versions via the wppa_image_magick function. This is due to
  insufficient sanitization of the multipart upload filename before
  concatenation into a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-74
vendor: opajaap
product: WP Photo Album Plus
affected:
  - wp_photo_album_plus <= 9.2.09.002
published: '2026-09-19'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87909'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/trunk/wppa-functions.php#L4837
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/trunk/wppa-functions.php#L5286
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/trunk/wppa-photo-files.php#L281
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/trunk/wppa-photo-files.php#L860
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3701613%40wp-photo-album-plus&new=3701613%40wp-photo-album-plus
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/693c7554-5122-4527-8a9c-aa31ea9623b7?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00525
epssPercentile: 0.43285
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-19T13:20:30.630636Z'
ingestedAt: '2026-09-19T02:56:32.979Z'
---

## Overview

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.