CVE-2026-87909 is a remote code execution vulnerability in the WP Photo Album Plus plugin for WordPress affecting all versions up to 9.2.09.002. The vulnerability occurs in the wppa_image_magick function, where insufficient sanitization of multipart upload filenames leads to injection in an ImageMagick command executed via exec(). The plugin applies escapeshellcmd() to the whole command string but fails to quote individual arguments, allowing attackers with subscriber-level privileges or higher to inject additional command arguments. The filename sanitization performed at the database layer does not apply to the temporary file path used for ImageMagick processing, enabling exploitation.

An authenticated attacker with subscriber-level access or higher can execute arbitrary code on the server hosting the vulnerable WordPress plugin. This can lead to full compromise of the web server, including confidentiality, integrity, and availability impacts as reflected by the CVSS score of 7.5 (high).

No official patch or fix is currently documented. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict subscriber-level access and higher to trusted users only. Avoid uploading files with suspicious filenames. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.