What is the CVSS score of CVE-2026-54829?

CVE-2026-54829 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Photo Album Plus are affected by CVE-2026-54829?

WP Photo Album Plus, a widely-deployed WordPress plugin, contains a blind SQL injection vulnerability (CVE-2026-54829) that allows unauthenticated attackers to extract sensitive data including user…

How to fix or mitigate CVE-2026-54829?

Within 24 hours: Audit all WordPress installations for WP Photo Album Plus presence and version; isolate affected systems from internet-facing traffic if operationally feasible. Within 7 days: Disable the plugin across all installations, or implement WAF rules blocking access to plugin-related endpoints (wp-content/plugins/photo-album-plus/*); deploy database activity monitoring for SQL injection signatures. Within 30 days: Monitor Patchstack and WordPress plugin repository for patch release; develop post-patch upgrade plan; validate all systems before re-enabling.

WP Photo Album Plus CVE-2026-54829

EUVD-2026-39392 HIGH

SQL Injection (CWE-89)

2026-06-25 Patchstack

GHSA-cr8m-2vj9-r7h2

WordPress SQLi Wp Photo Album Plus Wordpress Plugin Jacob N Breetvelt

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

5.9 MEDIUM

Unauthenticated network blind SQLi (AV:N/PR:N) with high complexity (AC:H); impact is confidentiality-only and confined to the database, so S:U with I:N/A:N rather than Patchstack's S:C/A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:26 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection.

This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

AnalysisAI

Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.

Technical ContextAI

The vulnerability is a CWE-89 SQL Injection - specifically the blind variant, where the application returns no direct database output, so an attacker infers data character-by-character through boolean or time-based response differences. The affected component is WP Photo Album Plus, a PHP-based WordPress gallery/photo-album plugin authored by Jacob N. Breetvelt (CPE: cpe:2.3:a:jacob_n._breetvelt:wp_photo_album_plus). The root cause is improper neutralization of special elements in a SQL command, meaning a request parameter is concatenated into a query without parameterized statements or adequate sanitization/escaping (e.g., missing use of WordPress's $wpdb->prepare()). Because WordPress plugins share the site's single MySQL/MariaDB database, a successful injection exposes the entire wp_ schema, including wp_users and wp_options.

RemediationAI

Upgrade WP Photo Album Plus to a release newer than 9.1.13.005 once the maintainer publishes a fixed version; the input data does not specify an exact patched version, so this is best characterized as no vendor-released patched version independently confirmed at time of analysis - verify the fixed build against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-1-13-005-sql-injection-vulnerability before deploying. Until a confirmed patch is available, compensating controls include deploying a WordPress-aware WAF (such as Patchstack's own virtual patching or an equivalent ruleset) to filter SQL injection patterns against the plugin's endpoints, with the trade-off of possible false positives on legitimate gallery queries; restricting or temporarily deactivating the WP Photo Album Plus plugin if the photo-album functionality is non-essential, which removes the attack surface entirely at the cost of losing the feature; and tightening the database account used by WordPress to least privilege so an injection cannot reach tables beyond what the site requires. Do not rely on generic input filtering alone, since blind SQLi payloads are easily encoded around naive blocklists.