Security Alert Summary
A SQL injection vulnerability was identified in the WP Photo Album Plus plugin before 9.1.11.001. The plugin does not properly sanitize and escape a parameter before using it in a SQL query, which can allow unauthenticated users to perform SQL injection and access sensitive data stored in the site database.
CVE Details
- CVE ID: CVE-2026-6379
- Affected component: WP Photo Album Plus WordPress plugin
- Affected versions: Versions before 9.1.11.001
- Published: May 18, 2026 at 7:16:12 AM
- Last modified: May 18, 2026 at 3:16:26 PM
- CVSS v3.1: Base score 8.6, severity HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Authentication / privileges / user interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
Technical Details
The plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query, which allows an unauthenticated attacker to supply crafted input that alters the intended SQL command. This is a classic SQL injection issue: because user-supplied data is used in a query without sufficient validation or escaping, an attacker can make the database return or expose data it should not.
The CVE description does not name specific functions or REST endpoints, so no implementation details beyond the missing input sanitization are provided. The primary impact indicated by the CVSS vector is disclosure of confidential information rather than modification or denial of service.
How This Could Impact Your Website
On a typical site using WP Photo Album Plus, the site owner might allow internal staff and external contributors to upload and manage photo content. An unauthenticated attacker exploiting this SQL injection could query the database and retrieve sensitive records such as stored user information or internal configuration data. Practical consequences include exposure of internal user email addresses and other personal data that could increase the risk of targeted phishing or social engineering against staff and contributors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts with file or media privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and database access logs for unusual queries or data exports.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
