CVE-2026-92115 opajaap CVE debrief

Who should care

Site administrators and defenders responsible for WordPress installations using the WP Photo Album Plus plugin should assess exposure and prioritize remediation. They should verify ImageMagick usage, restrict the `wppa_upload` capability, and monitor for suspicious activity. Additionally, security teams and vulnerability management teams should review the vulnerability and its potential impacts on their systems.

Why it matters

CVE-2026-92115 allows authenticated attackers to execute arbitrary operating-system commands, potentially leading to full server compromise if ImageMagick is enabled. Defenders should prioritize verifying ImageMagick usage, restricting `wppa_upload` capability, and monitoring for suspicious activity.

• Remote code execution as web-server user
• Potential for full server compromise
• Need for verification of ImageMagick usage
• Prioritization of patching or mitigating vulnerable plugin

Technical summary

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`. Further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible

Defensive priority

Defenders should prioritize verifying ImageMagick usage, restricting `wppa_upload` capability, and monitoring for suspicious activity.

Recommended defensive actions

• Verify ImageMagick usage and restrict access to the `wppa_upload` capability
• Monitor for suspicious activity and implement compensating controls
• Apply patches or updates to the WP Photo Album Plus plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw into an ImageMagick command string before being passed to `exec()`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.