EUVD-2026-30734
GHSA-m8jw-9h36-m622
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend crafted HTTP request with SQL payload
-
ExploitInject into unsanitized database query
-
ExecutionExtract user credentials and sensitive data
-
ImpactExfiltrate dumped database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of WP Photo Album Plus prior to 9.1.11.001; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reachability, low complexity, no privileges, and no user interaction. The only prerequisites are that the target WordPress site has the plugin installed and activated at a version below 9.1.11.001 and that the vulnerable parameter/endpoint is reachable over HTTP(S). Limiting factors: exploitation is confined to the injectable parameter and, per CVSS, yields confidentiality impact only (data disclosure) with no direct write/modification or availability impact; sites already updated to 9.1.11.001 or that have deactivated the plugin are not exposed. |
| Impact | Signals are mixed and must be weighed carefully. CVSS is 8.6 (High) driven by an easy remote path (AV:N/AC:L/PR:N/UI:N) and a scope change (S:C) with high confidentiality impact but no integrity or availability impact (I:N/A:N) - consistent with a read-oriented SQL injection that can exfiltrate data but is not scored for data modification or DoS. SSVC reinforces exploitability: exploitation status is 'poc', the flaw is 'automatable: yes' (typical for unauthenticated SQLi discoverable and scriptable at scale), and technical impact is 'partial'. Counterbalancing this, the EPSS probability is only 0.04% (14th percentile) and the vulnerability is NOT in CISA KEV, indicating no confirmed active exploitation yet despite public POC. The practical read: this is a genuinely exploitable, easily automatable unauthenticated data-disclosure bug that warrants prompt patching, but current evidence points to opportunistic/potential rather than confirmed widespread exploitation. Note the tension worth flagging: automatable=yes plus public POC usually precedes a rise in mass scanning, so the low EPSS may lag real-world activity. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running a vulnerable WP Photo Album Plus version and sends a crafted HTTP request that injects SQL through the unsanitized parameter. Because public exploit code exists and the flaw is automatable, the attacker scripts the request to dump wp_users records - usernames and password hashes - and other sensitive database contents without any login or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).
RemediationAI
Vendor-released patch: upgrade WP Photo Album Plus to version 9.1.11.001 or later, which is available from the vendor and resolves the SQL injection. Apply the update from the WordPress plugin admin or the WordPress.org repository as the primary and definitive fix. If immediate patching is not possible, apply compensating controls: place a WAF or WordPress security rule in front of the site to filter SQL metacharacters on the vulnerable parameter (trade-off: rule tuning may cause false positives on legitimate gallery queries), restrict or temporarily deactivate the plugin if the gallery feature is non-essential (trade-off: loss of photo-album functionality), and restrict web access to the affected endpoints where feasible. Review the WPScan advisory (https://wpscan.com/vulnerability/60b88fd2-4048-4773-b319-63caaf5bd8eb/) for detail. Because the injection can read credential hashes, rotate WordPress user passwords and secret keys after patching if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in the WP Photo Album Plus plugin for WordPress, a gallery/photo-management extension that stores and queries image and album metadata in the WordPress MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a user-controllable parameter is concatenated into a SQL query without proper sanitization or escaping and without using parameterized statements (e.g., WordPress $wpdb->prepare()). Because WordPress plugins share the single site database, an injection point in one plugin can read data across the entire wp_ schema, including the wp_users and wp_usermeta tables. The CPE cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:* confirms all versions prior to the fixed release are affected.
Know when Wp Photo Album Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) reads data beyond the plugin's scope (S:C, C:H); no confirmed write or availability impact, so I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Executive ViewAI
WordPress sites using WP Photo Album Plus versions before 9.1.11.001 face direct credential theft via an unauthenticated SQL injection vulnerability with publicly available exploit code. Attackers can access user databases and passwords without authentication, putting administrative accounts at immediate risk. Organizations must patch immediately and rotate user credentials to prevent account takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wp Photo Album Plus
View allUnauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to p
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unaut
Reflected cross-site scripting in WP Photo Album Plus before 9.2.11.002 allows remote unauthenticated attackers to injec
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress us
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject pers
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attacker
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authentic
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remot
Exploit-DB