---
id: CVE-2026-92115
title: >-
  WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection
  via 'value' Parameter (crop item) in update-photo AJAX Action
summary: >-
  The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated
  Command Injection in all versions up to, and including, 9.3.02.002 via the
  `value` parameter of the `update-photo` AJAX action. This is due to
  insufficient shell…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-77
vendor: opajaap
product: WP Photo Album Plus
affected:
  - wp_photo_album_plus <= 9.3.02.002
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T14:53:46.430953Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:37.836Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92115'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/fc663d68-ca52-4012-847f-09817c121890?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-photo-files.php#L874
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-photo-files.php#L859
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2557
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2211
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.3.01.003/wppa-ajax.php#L2223
  - url: 'https://downloads.wordpress.org/plugin/wp-photo-album-plus.9.3.02.003.zip'
tags:
  - cve.org
epss: 0.01475
epssPercentile: 0.73386
ingestedAt: '2026-10-16T07:01:11.476Z'
---

## Overview

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.

## Affected

- `wp_photo_album_plus <= 9.3.02.002`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.