Executive brief
WP Photo Album Plus, a WordPress plugin used for managing and displaying photo galleries, contains a security flaw that could allow an attacker to access sensitive information from the website's database. While the exploit typically requires administrative access, it can also be triggered if a logged-in administrator is tricked into visiting a malicious website. This could lead to the unauthorized exposure of private site data and user information.
Technical details
The WP Photo Album Plus plugin for WordPress is vulnerable to SQL injection due to insufficient escaping of the 'table' parameter and a lack of proper query preparation in the export-table endpoint. Authenticated attackers with administrator-level privileges can exploit this to append arbitrary SQL queries and extract sensitive data from the database. Additionally, the endpoint lacks a nonce check, making it susceptible to Cross-Site Request Forgery (CSRF), which allows an unauthenticated attacker to trigger the injection by tricking an administrator into performing an action. The vulnerability is present in all versions up to and including 9.2.04.002.
Affected products
- opajaap WP Photo Album Plus up to, and including, 9.2.04.002
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.02.003/wppa-admin-functions.php
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.02.003/wppa-admin-functions.php
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.02.003/wppa-ajax.php
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.02.003/wppa-input.php
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.03.001/wppa-admin-functions.php
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.03.001/wppa-admin-functions.php
- https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.2.03.001/wppa-ajax.php