PT-2026-39315
CVE-2026-6379
·
Published
2026-05-08
·
Updated
2026-06-11
Description by
CVSS 3.1
8.6
HighMetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
WP Photo Album Plus versions prior to 9.1.11.001
Description
The plugin fails to properly sanitize and escape a parameter before its use in a SQL query. This allows unauthenticated users to execute SQL injection attacks, which involve inserting malicious SQL statements into entry fields for execution by the database.
Recommendations
Update to version 9.1.11.001 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾