WP Photo Album Plus <= 9.2.09.002 — Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP Photo Album Plus.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 9.3.01.003, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WP Photo Album Plus to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to daroo.

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 18, 2026

   CVE published

   Severity high, CVSS 7.5

2. Nov 13, 2026

   Record last updated