CVE-2026-87909: opajaap wp photo album plus Injection

Vulnerability summary

CVE-2026-87909 is a high (CVSS 7.5) Injection vulnerability in opajaap wp photo album plus. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities. Fixed in 9.3.01.003.

Timeline

1. 19-09-2026
   PublishedVulnerability first disclosed.
2. 19-09-2026
   Last modifiedVulnerability information updated.

Description

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.