A SQL injection vulnerability exists in WP Photo Album Plus plugin for WordPress, allowing for blind SQL injection attacks. The issue affects versions from n/a through 9.1.13.005. Defenders responsible for WordPress installations with the WP Photo Album Plus plugin should assess exposure and prioritize patching or mitigation to prevent potential SQL injection attacks. This vulnerability could lead to unau [truncated]
CRITICALJacob N. BreetveltCVE published 2026-06-15
CVE-2026-39511 is a critical unauthenticated SQL injection vulnerability in WP Photo Album Plus versions <= 9.1.08.001. The vulnerability has a CVSS score of 9.3 and is considered critical. It was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-39511) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-39511).