CVE-2026-92115: WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka() function, where the attacker-controlled value parameter is concatenated raw — without escapeshellarg() — into an ImageMagick command string before being passed to exec(); further, wppadecode() actively restores percent-encoded shell metacharacters (e.g., %26→&, %23→#) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined wppaupload capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the wppaupload capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress and hold the plugin-defined wppa_upload capability. Administrators may have granted that capability to lower-privileged WordPress roles through the plugin’s Users settings.
What server-side condition is required for exploitation?
ImageMagick must be enabled on the server. The vulnerable update-photo AJAX action reaches an ImageMagick command path where the attacker-controlled value parameter is incorporated into a command executed by the web server.
What level of access could successful exploitation provide?
Successful exploitation can execute arbitrary operating-system commands as the web-server user. This can result in remote code execution on the underlying server, with the practical impact determined by that user’s operating-system permissions.
Which deployments should be prioritized for review?
Prioritize installations running WP Photo Album Plus 9.3.02.002 or earlier that have ImageMagick enabled, especially where wppa_upload has been delegated beyond tightly controlled administrative users. Review the plugin’s Users settings to identify which WordPress roles or accounts have that capability.