WP Photo Album Plus EUVD-2026-102802

Exploitation requires three concrete conditions: (1) the server must have ImageMagick enabled as the image-processing backend, since the injection occurs inside the wppa_image_magick_a() ImageMagick command string - sites using GD instead are not affected; (2) the attacker must authenticate as a WordPress user holding the plugin-specific wppa_upload capability, which is not a default role privilege but can be delegated by administrators to lower-privileged roles via the plugin's Users settings; and (3) the attack targets the update-photo AJAX action's value parameter. The percent-encoding sanitization bypass is inherent to the plugin's wppa_decode() behavior and requires no special configuration. Limiting factors: no code execution is possible without the wppa_upload capability and without ImageMagick active, so default WordPress installs that have not delegated the capability or that use GD are not exploitable.

This is a genuine high-priority vulnerability for sites running the affected plugin, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates remote exploitation over the network, low complexity, no user interaction, and high impact across confidentiality, integrity, and availability - consistent with the described command injection leading to full RCE as the web-server user. The PR:L metric correctly reflects that authentication is required, but the key amplifier is that the required privilege is the plugin-defined wppa_upload capability, which administrators may delegate to lower-privileged roles, widening the attacker pool well beyond admins. No EPSS score, KEV listing, or POC was supplied in the input; per the data provided there is no public exploit identified and no evidence of active exploitation, so urgency rests on the intrinsic severity and ease of weaponization rather than confirmed in-the-wild activity. One genuine limiter that the raw CVSS does not capture: exploitation requires ImageMagick to be enabled on the server, so sites using GD or without ImageMagick configured are not exploitable via this path - verify this environmental precondition before treating any given install as vulnerable.

An attacker who holds (or is granted) the wppa_upload capability - potentially a low-privileged, non-admin WordPress user - sends a crafted request to the update-photo AJAX action with a malicious value parameter containing percent-encoded shell metacharacters. Because wppa_decode() restores these characters and the value is concatenated without escapeshellarg() into the ImageMagick command passed to exec(), the attacker breaks out of the argument context and runs arbitrary OS commands as the web-server user. No public exploit is identified at time of analysis, but the flaw is straightforward to weaponize on servers where ImageMagick is enabled.