An authenticated remote code execution vulnerability in the WP Photo Album Plus plugin allows attackers with subscriber-level access to execute arbitrary commands on the server.

The vulnerability exists in the wppa_image_magick function, where insufficient sanitization of multipart upload filenames allows for command injection into an ImageMagick execution string. This flaw is exploitable by any authenticated user with at least subscriber-level permissions.

Successful exploitation of this vulnerability results in full remote code execution on the underlying web server. This grants an attacker the ability to compromise sensitive data, modify application files, or pivot deeper into the internal network. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to site integrity and confidentiality, necessitating immediate remediation to prevent unauthorized system control.

Immediate Action: Update the WP Photo Album Plus plugin to version 9.3.01.003 or newer immediately to resolve the vulnerable command execution path.

Proactive Monitoring: Review web server access logs for anomalous requests containing shell metacharacters or unexpected file extensions in image upload parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious command patterns in HTTP POST requests, which may provide temporary protection until the update is applied.

Public Exploit Available: No

Given the potential for complete system compromise via remote code execution, organizations utilizing this plugin must prioritize the update to version 9.3.01.003. Administrators should also audit current user accounts to ensure that unauthorized or untrusted users do not possess subscriber-level access, which is the minimum requirement to trigger this exploit.