CVE-2026-87909 Details

A remote code execution vulnerability has been identified in the WP Photo Album Plus plugin for WordPress, affecting all versions. The issue arises in the 'wppa_image_magick' function, where the multipart upload filename is inadequately sanitized before being added to an ImageMagick command string executed with 'exec()'. This flaw allows authenticated attackers with subscriber-level access and above to execute arbitrary code on the server. The vulnerability exists because 'escapeshellcmd()' only escapes shell metacharacters at a command level, leaving spaces as argument separators, and the filename sanitization applied at the database level does not extend to the physical temporary file path used for ImageMagick processing.

Users are advised to update the WP Photo Album Plus plugin to version 9.3.01.003 or a newer patched version.