CVE-2026-92115: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in opajaap WP Photo Album Plus
Description
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.
CVSS v3.1
Score 8.8high
Affected software
opajaap
WP Photo Album Plus
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92115 is an authenticated command injection vulnerability in WP Photo Album Plus plugin for WordPress, affecting all versions up to and including 9.3.02.002. The flaw exists because the 'value' parameter of the 'update-photo' AJAX action is concatenated directly into an ImageMagick command string without proper shell escaping (escapeshellarg), and percent-encoded shell metacharacters are restored rather than sanitized. This allows attackers with the plugin-level 'wppa_upload' capability to execute arbitrary operating system commands as the web server user, resulting in full remote code execution. The vulnerability requires ImageMagick to be enabled on the server. The 'wppa_upload' capability can be assigned to non-administrator WordPress roles, broadening potential exploitation.
Potential Impact
Successful exploitation allows authenticated users with the 'wppa_upload' capability to execute arbitrary commands on the underlying server with the privileges of the web server user. This leads to full remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact. The attack surface is increased because the required capability can be granted to lower-privileged WordPress roles.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the 'wppa_upload' capability to trusted administrators only and disable ImageMagick if not required. Monitor plugin updates from the vendor for a security patch addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-15T15:44:49.706Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad1cc6e2cdf04f656c71865
Added to database: 10/16/2026, 07:04:14 UTC
Last enriched: 10/16/2026, 07:18:25 UTC
Last updated: 10/16/2026, 19:03:29 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.