CVE-2026-6379

The WP Photo Album Plus plugin for WordPress, versions before 9.1.11.001, contains an unauthenticated SQL injection vulnerability. The plugin fails to properly sanitize and escape the 'wppa-supersearch' parameter before incorporating it into a SQL query, enabling an attacker to inject arbitrary SQL commands [1].

Exploitation requires no authentication; an unauthenticated attacker can send a crafted HTTP request containing malicious SQL in the 'wppa-supersearch' parameter. The parameter is processed by the plugin without adequate input validation, allowing the injection to be executed against the WordPress database [1].

Successful exploitation allows an attacker to read sensitive data from the database, such as user credentials, session tokens, and other stored information. This could lead to further compromise of the WordPress site, including privilege escalation or data exfiltration [1].

The vulnerability has been fixed in version 9.1.11.001 of the plugin. Users are strongly advised to update to this version or later to mitigate the risk. No workarounds have been provided [1].