CVE-2026-15344

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.04.003

Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with administrator-level access to perform SQL Injection. By manipulating the table parameter, attackers can append additional queries to extract sensitive information from the database. Additionally, the 'export-table' endpoint lacks a nonce check, which enables Cross-Site Request Forgery (CSRF)—a technique where a user is tricked into executing unwanted actions on a web application—allowing the issue to be triggered by tricking an administrator into visiting a malicious page.

Recommendations Update to a version newer than 9.2.04.002. Avoid using the table parameter in the 'export-table' endpoint until the update is applied.