What is the CVSS score of CVE-2026-6379?

CVE-2026-6379 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WP Photo Album Plus are affected by CVE-2026-6379?

WordPress sites using WP Photo Album Plus versions before 9.1.11.001 face direct credential theft via an unauthenticated SQL injection vulnerability with publicly available exploit code.. A patch is available.

Is there a public PoC exploit available for CVE-2026-6379?

Yes, a public proof-of-concept exploit is available for CVE-2026-6379. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6379?

Within 24 hours, identify all WordPress instances using WP Photo Album Plus and document their versions. Within 7 days, update all affected installations to version 9.1.11.001 or later according to vendor advisory, prioritizing production and administrator-focused environments. Within 30 days, audit database access logs for unauthorized queries, force password resets for all users, confirm patches applied across all environments, and implement WordPress vulnerability scanning to detect similar issues.

WP Photo Album Plus CVE-2026-6379

EUVD-2026-30734 HIGH

SQL Injection (CWE-89)

2026-05-18 WPScan

GHSA-m8jw-9h36-m622

WordPress SQLi Wp Photo Album Plus

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) reads data beyond the plugin's scope (S:C, C:H); no confirmed write or availability impact, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:03 vuln.today

Patch available

May 18, 2026 - 09:01 EUVD

CVE Published

May 18, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 18, 2026 - 06:00 cve.org

HIGH 8.6

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

AnalysisAI

SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).

Technical ContextAI

The vulnerability lies in the WP Photo Album Plus plugin for WordPress, a gallery/photo-management extension that stores and queries image and album metadata in the WordPress MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a user-controllable parameter is concatenated into a SQL query without proper sanitization or escaping and without using parameterized statements (e.g., WordPress $wpdb->prepare()). Because WordPress plugins share the single site database, an injection point in one plugin can read data across the entire wp_ schema, including the wp_users and wp_usermeta tables. The CPE cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:* confirms all versions prior to the fixed release are affected.

RemediationAI

Vendor-released patch: upgrade WP Photo Album Plus to version 9.1.11.001 or later, which is available from the vendor and resolves the SQL injection. Apply the update from the WordPress plugin admin or the WordPress.org repository as the primary and definitive fix. If immediate patching is not possible, apply compensating controls: place a WAF or WordPress security rule in front of the site to filter SQL metacharacters on the vulnerable parameter (trade-off: rule tuning may cause false positives on legitimate gallery queries), restrict or temporarily deactivate the plugin if the gallery feature is non-essential (trade-off: loss of photo-album functionality), and restrict web access to the affected endpoints where feasible. Review the WPScan advisory (https://wpscan.com/vulnerability/60b88fd2-4048-4773-b319-63caaf5bd8eb/) for detail. Because the injection can read credential hashes, rotate WordPress user passwords and secret keys after patching if compromise is suspected.