CVE-2026-15344
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The WP Photo Album Plus plugin for WordPress up to version 9.2.04.002 is vulnerable to SQL Injection via the 'table' parameter. Insufficient escaping and query preparation allow authenticated attackers with administrator access to append additional SQL queries. The lack of a nonce in the export endpoint also enables CSRF attacks.
Risk Assessment
An attacker can extract sensitive data from the database, such as passwords or user data, leading to data confidentiality and integrity breaches.
Recommendation
Update the plugin to the latest version. Restrict access to the export function to trusted administrators and add nonce verification.
Other vulnerabilities in WP Photo Album Plus
See all- CVE-2026-57675High
The WP Photo Album Plus plugin version 9.2.02.004 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-10095Medium
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in versions up to and including 9.1.13.005 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.
- CVE-2026-39511Critical
There is an unauthenticated SQL injection vulnerability in WP Photo Album Plus versions up to 9.1.08.001.
- CVE-2026-18962Medium
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when processing a front-end upload. This allows any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the plugin's front-end user upload feature to be enabled, which is not the default.
- CVE-2026-18049High
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
- CVE-2026-18048High
The WP Photo Album Plus plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorization check. This allows unauthenticated attackers to delete arbitrary ZIP archives on the server, including those outside the web root.
- CVE-2026-17013Medium
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.
Original NVD description (English source)
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The export-table endpoint lacks a nonce check, meaning this vulnerability can also be triggered via CSRF by tricking an authenticated administrator into visiting a malicious page.