CVE-2026-92115 WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka function, where the...

CVE-2026-92115

The WP Photo Album Plus plugin for WordPress (versions up to and including 9.3.02.002 ) is vulnerable to Command Injection via the value parameter of the update-photo AJAX action. The root cause is the lack of escapeshellarg() within the wppa_image_magick_a() function, combined with wppa_decode()...

EUVD-2026-102802

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka function, where the...