{"id":"CVE-2026-92115","kind":"vulnerability","aliases":["CVE-2026-92115"],"related":[],"title":"WP Photo Album Plus: authenticated command injection gives server code execution","description":"The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.","summary":"The WP Photo Album Plus WordPress plugin passes a user-supplied value into an ImageMagick shell command without escaping it, and it decodes percent-encoded shell characters. A logged-in user holding the plugin's wppa_upload capability can run operating-system commands as the web-server user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imagemagick","package","self-hosted","wordpress","wp-photo-album-plus"],"not_affected_if":["imagemagick-disabled","no-wppa-upload-grants","plugin-not-installed"],"how_to_check":"Check the installed WP Photo Album Plus version in the WordPress Plugins screen; versions up to and including 9.3.02.002 are affected. Confirm whether ImageMagick is enabled in the plugin's settings or the server PHP configuration.","fix":"Update to a release newer than 9.3.02.002; the sources do not name the patched version. Until then, review which roles hold wppa_upload in the plugin's Users settings and remove grants you do not need.","status":"open","published_at":"2026-10-16T07:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:34:55+00:00","updated_at":"2026-10-23T22:34:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:34:55Z","model":"claude-haiku-5-5","output":{"fix":"Update to a release newer than 9.3.02.002; the sources do not name the patched version. Until then, review which roles hold wppa_upload in the plugin's Users settings and remove grants you do not need.","reach":"internet","title":"WP Photo Album Plus: authenticated command injection gives server code execution","impact":"high","summary":"The WP Photo Album Plus WordPress plugin passes a user-supplied value into an ImageMagick shell command without escaping it, and it decodes percent-encoded shell characters. A logged-in user holding the plugin's wppa_upload capability can run operating-system commands as the web-server user.","category":"package","who_cares":["wordpress","wp-photo-album-plus","self-hosted","imagemagick"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs OS commands as web-server user, full remote code execution","analyst_note":"","how_to_check":"Check the installed WP Photo Album Plus version in the WordPress Plugins screen; versions up to and including 9.3.02.002 are affected. Confirm whether ImageMagick is enabled in the plugin's settings or the server PHP configuration.","needs_analyst":false,"not_affected_if":["plugin-not-installed","imagemagick-disabled","no-wppa-upload-grants"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00101,"input_tokens":3232,"output_tokens":1374,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92115':14A,17A '23':163C '26':162C '9.3.02.002':103C 'achiev':210C 'action':114C 'activ':154C 'administr':240C,262C 'ajax':113C 'album':3A,27B,32B,85C 'allow':168C 'arbitrari':199C 'argument':180C 'attack':132C,188C,260C 'attacker-control':131C 'authent':5A,93C,187C 'beyond':261C 'break':175C 'broaden':255C 'capabl':69B,196C,231C 'charact':57B 'code':10A,213C 'command':6A,46B,75B,94C,144C,203C 'concaten':137C 'context':181C 'control':133C 'craft':169C 'cve':12A,15A 'decod':52B,153C 'defin':193C 'due':117C 'e.g':161C 'enabl':224C 'encod':55B,158C 'escap':48B,121C 'escapeshellarg':140C 'exec':150C 'execut':11A,198C,214C 'exploit':219C 'full':211C 'function':128C 'give':8A 'grant':242C 'hold':63B,189C 'host':22B 'imag':125C 'imagemagick':18B,44B,143C,179C,221C 'includ':102C 'inject':7A,95C 'insuffici':119C 'level':236C 'log':60B 'logged-in':59B 'lower':245C 'lower-privileg':244C 'magick':126C 'make':183C 'may':241C 'metacharact':160C 'oper':73B,201C 'operating-system':72B,200C 'packag':19B 'paramet':107C,135C 'pass':36B,148C 'payload':170C 'percent':54B,157C 'percent-encod':53B,156C 'photo':2A,26B,31B,84C,112C 'plugin':35B,65B,87C,192C,235C,251C 'plugin-defin':191C 'plugin-level':234C 'plus':4A,28B,33B,86C 'pool':257C 'possibl':185C 'potenti':259C 'privileg':237C,246C 'rather':164C 'raw':138C 'remot':212C 'requir':220C 'restor':155C 'role':248C 'run':71B 'sanit':173C 'self':21B 'self-host':20B 'server':9A,80B,208C,218C,227C 'set':254C 'shell':45B,56B,120C,159C 'site':239C 'string':145C 'strip':166C 'suppli':40B 'surviv':172C 'system':74B,202C 'under':217C 'updat':111C 'update-photo':110C 'upload':68B,195C,230C 'user':39B,62B,81B,209C,253C 'user-suppli':38B 'valu':41B,106C,134C 'version':98C 'via':104C,249C 'vulner':91C 'web':79B,207C 'web-serv':78B,206C 'within':122C 'without':47B,139C 'wordpress':23B,34B,89C,247C 'wp':1A,25B,30B,83C 'wp-photo-album-plus':24B 'wppa':67B,124C,152C,194C,229C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92115","severity":null,"published_at":"2026-10-16T07:17:13+00:00","modified_at":"2026-10-16T15:17:35+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}