PatchSiren cyber security CVE debrief
CVE-2026-39511 Jacob N. Breetvelt CVE debrief
CVE-2026-39511 is a critical unauthenticated SQL injection vulnerability in WP Photo Album Plus versions <= 9.1.08.001. The vulnerability has a CVSS score of 9.3 and is considered critical. It was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-39511) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-39511).
- Vendor
- Jacob N. Breetvelt
- Product
- WP Photo Album Plus
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-15
Who should care
Users of WP Photo Album Plus versions <= 9.1.08.001 should update to a patched version as soon as possible.
Technical summary
The vulnerability is an unauthenticated SQL injection vulnerability in WP Photo Album Plus versions <= 9.1.08.001. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
Defensive priority
high
Recommended defensive actions
- Update WP Photo Album Plus to a version greater than 9.1.08.001.
- Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-1-08-001-sql-injection-vulnerability?_s_id=cve) for mitigation or vendor guidance
Evidence notes
The vulnerability was reported by [email protected] and is classified as CWE-89.
Official resources
-
CVE-2026-39511 CVE record
CVE.org
-
CVE-2026-39511 NVD detail
NVD
-
Source item URL
nvd_modified
- Mitigation or vendor reference
CVE-2026-39511 was published on 2026-06-15T21:16:45.730Z and last modified on 2026-06-15T21:24:32.790Z.