WP Photo Album Plus RCE Lets Subscribers Hijack ImageMagick Commands

Executive Summary

A high-severity remote code execution vulnerability (CVE-2026-87909) has been disclosed in WP Photo Album Plus, a WordPress photo gallery plugin with roughly 10,000 active installations. Rated CVSS 7.5, the flaw lets authenticated attackers with Subscriber-level access or above execute arbitrary code on the server through the plugin's wppa_image_magick function.

CVSS Score: 7.5 (High)

The vulnerability stems from insufficient sanitization of the multipart upload filename before it is concatenated into an ImageMagick command string executed via exec(). The plugin only applies escapeshellcmd() to the whole command rather than quoting individual arguments — which escapes shell metacharacters but does not stop argument injection, since spaces still act as argument separators. Compounding the issue, filename sanitization applied at the database layer is never applied to the physical temporary file path actually handed to ImageMagick.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker registers or obtains a Subscriber-level WordPress account
2. Attacker uploads an image with a crafted multipart filename containing shell argument syntax
3. Plugin sanitizes the filename for database storage, but NOT the physical temp file path
4. wppa_image_magick() concatenates the unsanitized filename into an ImageMagick exec() command
5. escapeshellcmd() escapes metacharacters but does not prevent argument injection via spaces
6. Injected arguments are interpreted by ImageMagick's command-line processing, enabling code execution

Because only Subscriber-level access is required — the lowest privilege tier on most WordPress sites, often available via open registration — this significantly lowers the bar for exploitation compared to admin-only vulnerabilities.

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 9.3.01.003

# Via WP-CLI
wp plugin update wp-photo-album-plus
 
# Verify the installed version
wp plugin get wp-photo-album-plus --field=version

Or update through WordPress admin: Plugins > Installed Plugins > WP Photo Album Plus > Update Now.

Step 2: Review Subscriber Registrations

1. Navigate to Users > All Users and filter by Subscriber role
2. Audit recently registered accounts for suspicious activity
3. Disable open user registration (Settings > General > Membership) if not required

Step 3: Scan for Existing Compromise

# Search for recently uploaded files with unusual filenames in the plugin's upload paths
find /path/to/wordpress/wp-content/uploads/wppa/ -type f -newer /path/to/wordpress/wp-includes/version.php
 
# Check for webshell signatures
grep -rl "eval\s*(base64_decode\|system\s*(\|shell_exec\s*(" /path/to/wordpress/wp-content/uploads/wppa/

If Immediate Patching Is Not Possible

1. Disable open user registration to prevent low-cost account creation
2. Restrict photo upload permissions to trusted roles only, if the plugin supports it
3. Monitor server-level exec() calls originating from PHP-FPM/Apache worker processes if feasible

Detection Indicators

Post-Remediation Steps

1. Confirm plugin updated to 9.3.01.003 or later
2. Audit Subscriber accounts created since the plugin was last updated
3. Scan the installation for webshells and unauthorized files
4. Rotate credentials — WordPress admin, database, API keys
5. Consider disabling open registration permanently if not business-critical

References

• SecNews.gr — Photo Album Plus: Critical RCE via ImageMagick
• NIST NVD — CVE-2026-87909

Related Reading

• Gravity Forms Unauthenticated File Upload Lets Attackers Achieve RCE
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+