This vulnerability (CVE-2026-39511) is an instance of CWE-89, improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects WP Photo Album Plus versions up to 9.1.08.001, allowing unauthenticated attackers to execute SQL injection attacks remotely. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, leading to disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not indicated. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the vulnerable plugin functionality or disabling the plugin if feasible. Monitor official channels for updates from the vendor Jacob N. Breetvelt regarding fixes.