Executive brief
WP Photo Album Plus is a WordPress plugin that manages photo galleries. The plugin fails to properly sanitize file names when processing images with ImageMagick, allowing authenticated users with subscriber-level access to run arbitrary code on the web server. An attacker with a low-privilege account could gain full control of the website and its data.
Technical details
The wppa_image_magick function concatenates user-supplied upload filenames directly into an ImageMagick command executed via exec(). Although escapeshellcmd() is applied, it only escapes shell metacharacters and does not prevent argument injection; spaces in filenames remain as argument separators, allowing command injection. The vulnerability requires authenticated access at subscriber level or above, and affects image processing during multipart upload.
Affected products
- wpsoul WP Photo Album Plus all versions
Timeline
- 2026-09-19: disclosed