The WP Photo Album Plus WordPress plugin is vulnerable to SQL Injection through insufficient escaping and lack of prepared statements on the 'table' parameter in all versions up to 9.2.04.002. This allows authenticated administrators to inject additional SQL commands, potentially exposing sensitive data. The export-table endpoint does not implement a nonce check, enabling Cross-Site Request Forgery attacks that can trigger this vulnerability if an administrator visits a malicious page.

An attacker with administrator-level access can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The lack of nonce verification on the export-table endpoint increases the attack surface by allowing CSRF attacks to trigger the SQL Injection without direct user interaction beyond visiting a malicious page. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and avoid visiting untrusted web pages while authenticated as an administrator. Monitor vendor channels for updates addressing this vulnerability.