What is the CVSS score of CVE-2026-39511?

CVE-2026-39511 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP Photo Album Plus are affected by CVE-2026-39511?

WP Photo Album Plus plugin (versions ≤9.1.08.001) contains a critical SQL injection vulnerability exploitable without authentication, enabling attackers to access your WordPress database and extract…

How to fix or mitigate CVE-2026-39511?

Within 24 hours: Inventory all WordPress installations running WP Photo Album Plus version 9.1.08.001 or earlier; immediately deactivate the plugin through WordPress admin console or by renaming the plugin directory to disable it. Within 7 days: If plugin functionality is business-critical, deploy Web Application Firewall rules (ModSecurity or equivalent) blocking SQL injection patterns targeting the plugin; enable MySQL/MariaDB query logging; review database access logs for evidence of exploitation. Within 30 days: Monitor Patchstack and vendor security advisories for patched version release; develop and test upgrade procedures; evaluate alternative plugins if vendor timeline extends beyond organizational risk tolerance.

WP Photo Album Plus CVE-2026-39511

EUVD-2026-36950 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-984x-crwg-rm3r

WordPress SQLi Wp Photo Album Plus Wordpress Plugin Jacob N Breetvelt

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.9 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) with scope change to other WP tables; raised I from N to L because SQLi sinks typically permit some write impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:23 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

AnalysisAI

Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 (scope-changed) and no public exploit identified at time of analysis, the flaw exposes WordPress sites running the plugin to database content disclosure and limited integrity/availability impact. Patchstack reported the issue and it carries CWE-89 (SQL Injection).

Technical ContextAI

WP Photo Album Plus is a WordPress photo gallery plugin authored by Jacob N. Breetvelt (CPE: cpe:2.3:a:jacob_n._breetvelt:wp_photo_album_plus). The root cause class, CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicates user-controlled input is concatenated into SQL queries executed against the WordPress wp_* database without proper parameterization or escaping via $wpdb->prepare(). Because the vulnerable code path is reachable without authentication, the attacker interacts directly with a public-facing plugin endpoint (typically admin-ajax.php, REST routes, or a public shortcode handler) that ultimately drives a SELECT/UPDATE query. The CVSS scope change (S:C) suggests the injected query can read or affect data beyond the plugin's own logical authorization boundary - i.e., reach other WordPress tables such as wp_users or wp_options.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data - administrators should upgrade WP Photo Album Plus to the latest version above 9.1.08.001 as published on the WordPress.org plugin repository and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-1-08-001-sql-injection-vulnerability for the fixed release number. If immediate patching is not possible, compensating controls include deactivating the WP Photo Album Plus plugin entirely (the cleanest mitigation, at the cost of losing gallery functionality), enabling a WAF such as Patchstack, Wordfence, or Cloudflare with a virtual patch / SQLi ruleset (effective but may produce false positives on legitimate gallery queries), and restricting access to the plugin's public endpoints (admin-ajax.php actions and any wppa-* REST/shortcode handlers) via web server rules where feasible. As defense-in-depth, ensure the WordPress database user has only the minimum required privileges to limit the blast radius of a successful injection.