CVE-2026-92115: the affected product Command Injection (CVSS 8.8)

CVE-2026-92115 affects the affected product. Before acting, confirm where the affected product runs in your estate, who owns it and whether it is reachable from the internet, because exposure decides real risk more than the score alone.

In plain terms: The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.

The weakness class is Command Injection. Untrusted input ends up inside a system command.

Based on its CVSS vector, the flaw can be reached over the network, needs some level of access, and needs no user interaction. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.