WP Photo Album Plus CVE-2026-39511

No special conditions - remote unauthenticated exploitation against default configurations of WordPress sites with the WP Photo Album Plus plugin installed and activated at version 9.1.08.001 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity. The only practical limiting factors are that the plugin must actually be installed and active (it is an optional third-party plugin, not bundled with WordPress core), the vulnerable endpoint must be reachable from the attacker (no IP allowlisting or WAF blocking the relevant action), and the WordPress database user must have sufficient privileges to read the targeted tables - which is normally the case in default WordPress deployments.

The signals are mixed but lean toward elevated priority: CVSS 3.1 is 9.3 with AV:N/AC:L/PR:N/UI:N (trivially reachable from the internet, no authentication, no user interaction) and S:C (scope change) amplifying impact, yet the impact triad is C:H/I:N/A:L - i.e., high confidentiality loss but no integrity impact and only low availability impact, which is consistent with a read-oriented blind/UNION SQLi rather than full DB takeover. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is not confirmed actively exploited. However, Patchstack-disclosed WordPress plugin SQLi historically attracts mass scanning within days once a public PoC lands, and the unauthenticated nature combined with WordPress's large attack surface means defenders should treat this as urgent even without KEV status. One caveat worth flagging: the CVSS vector asserts I:N, but most SQL injection primitives that achieve C:H can also write data - verify with the vendor whether the affected sink is strictly a read query.

An unauthenticated attacker sends a crafted HTTP request to a public WP Photo Album Plus endpoint (for example a gallery query parameter handled via admin-ajax.php or a REST route), embedding SQL syntax that breaks out of the intended query. The injected payload uses UNION SELECT or time-based blind techniques to read sensitive rows from wp_users (password hashes, emails) and wp_options (secret keys, API tokens). No public exploit identified at time of analysis, but Patchstack's advisory provides enough detail for skilled attackers to reproduce within hours of disclosure.