CVE-2026-6379
HighSummary
The WP Photo Album Plus WordPress plugin before version 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Risk Assessment
An attacker could exploit this vulnerability to gain access to the database, potentially leading to data theft or system compromise.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in WP Photo Album Plus WordPress plugin
See all- CVE-2026-17014Medium
The WP Photo Album Plus WordPress plugin before version 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
- CVE-2026-14922Medium
The WP Photo Album Plus plugin up to version 9.2.03.001 is vulnerable to stored Cross-Site Scripting (XSS) due to a double-encoding flaw in the photo comment pipeline. An attacker can submit a double HTML-entity-encoded payload (e.g., <img src=... onload=...>) that passes filters and is stored, then executes in the victim's browser.
Original NVD description (English source)
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.