opajaap WP Photo Album Plus Plugin up to 9.2.09.002 on WordPress ImageMagick wppa_image_magick os command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in opajaap WP Photo Album Plus Plugin up to 9.2.09.002. This vulnerability affects the function wppa_image_magick of the component ImageMagick Handler. The manipulation results in os command injection. This vulnerability is known as CVE-2026-87909. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in opajaap WP Photo Album Plus Plugin up to 9.2.09.002. It has been classified as critical. Affected is the function wppa_image_magick of the component ImageMagick Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

The advisory is available at wordfence.com. This vulnerability is traded as CVE-2026-87909 since 09/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/19/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• opajaap

Name

• WP Photo Album Plus Plugin

Version

• 9.2.09.002

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion