CVE-2026-87909

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.09.003

Description Authenticated users with subscriber-level access and above can achieve Remote Code Execution via the wppa image magick() function. The issue stems from insufficient sanitization of the multipart upload filename before it is concatenated into an ImageMagick command string executed via exec(). While escapeshellcmd() is applied to the entire command, it fails to prevent argument injection because spaces still act as argument separators, and the filename sanitization used at the database layer is not applied to the physical temporary file path used during ImageMagick processing.

Recommendations Update to a version newer than 9.2.09.002. As a temporary mitigation, restrict access to the wppa image magick() function for users with subscriber-level permissions.