CVE-2026-92115

Что произошло

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "0",
  "versionType": "semver",
  "lessThanOrEqual": "9.3.02.002"
}

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Источники и ссылки

{
  "cwes": [
    "cve"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-10-29T09:45:57.660988+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T17:34:28.956257+00:00"
  },
  "scores": [
    "cve"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T17:34:28.956257+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T17:34:28.956257+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-10-29T09:45:57.660988+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T17:34:28.956257+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены29.10.2026, 12:46
2. Опубликована28.10.2026, 20:34

Личная заметка и статус

Другие CVE того же продукта