EUVD-2026-83471
GHSA-mx4x-6r5x-jrh9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable by a subscriber (PR:L) with no victim interaction; AC:H because argument injection past escapeshellcmd requires ImageMagick-specific crafting; full server C/I/A on successful code execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.
AnalysisAI
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with subscriber-level access or above on a WordPress site running WP Photo Album Plus, and the site must use the ImageMagick processing path (wppa_image_magick calling exec() on ImageMagick). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine server-side Remote Code Execution flaw (CWE-74 argument injection), which places it in a higher-priority tier than the many mislabeled 'RCE' web-app findings that are actually client-side XSS - here the RCE tag is accurate because attacker-controlled filename text reaches an ImageMagick command executed via PHP exec(). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix referenced in WordPress plugin changeset 3701613 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3701613%40wp-photo-album-plus&new=3701613%40wp-photo-album-plus) or upgrade to a WP Photo Album Plus release that contains it; patch status is upstream fix available (changeset/commit); released patched version not independently confirmed, so verify the plugin version includes the corrected argument handling before relying on it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress instances for WP Photo Album Plus and determine whether ImageMagick is the active image processor; if so, deactivate the plugin or restrict all upload functionality to administrator-level users only, and deploy WAF rules to reject multipart filenames containing shell metacharacters or ImageMagick directives. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Photo Album Plus
View allUnauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to p
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unaut
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject a
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress us
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject pers
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attacker
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remot
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrendere
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthe
Share
External POC / Exploit Code
Leaving vuln.today