The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the…

CVE-2026-87909 is a remote code execution flaw in the wppa_image_magick function of the WP Photo Album Plus WordPress plugin (all versions through 9.2.09.002). When a user uploads a photo, the plugin builds an ImageMagick CLI command by concatenating the multipart upload filename into a string passed to exec(). The developer applied escapeshellcmd() to the *entire command*, which escapes shell metacharacters (;, |, ` `) but leaves spaces intact — meaning an attacker-controlled filename can inject *additional arguments* into the ImageMagick convert binary. ImageMagick's -write and MSL delegates have historically been abusable to write arbitrary files (webshells). The DB-layer filename sanitizer never touches the physical temp path, so the injection survives to the exec()` call. Authentication is required at the subscriber level or above.

The vendor's HIGH / 7.5 rating reflects the theoretical ceiling: authenticated RCE with full C/I/A impact. But the CVSS vector already includes AC:H (high complexity), and several compounding real-world prerequisites — WordPress open registration disabled by default, ImageMagick CLI required on the server *and* enabled in plugin settings, exec() not disabled by the host, and only ~10,000 active installs worldwide — mean the reachable population is a thin slice of a thin slice. The vendor score is technically defensible but overstates operational urgency for most defenders.

1. Update to WP Photo Album Plus 9.3.02.003 immediately — The current release (9.3.02.003, published 2026-09-22) almost certainly contains the fix given the version jump and disclosure timing. This is the definitive remediation. As a MEDIUM verdict, the noisgate remediation SLA allows up to 365 days, but given this is a simple plugin update with no compatibility risk, deploy within the next maintenance window.
2. Disable ImageMagick CLI in plugin settings — Navigate to WP Photo Album Plus → Settings → ImageMagick and disable the ImageMagick option or remove the binary path. The plugin falls back to PHP GD, which does not invoke exec() and eliminates the vulnerable code path entirely. This is the fastest compensating control — no mitigation SLA applies for MEDIUM, but do this today if you can't update immediately.
3. Add exec() to PHP disable_functions — In php.ini, add exec to disable_functions if not already present. This kills the entire class of shell-execution vulnerabilities in PHP, not just this one. Requires a PHP-FPM/Apache restart. Verify the plugin and other functionality still work with GD fallback.
4. Disable WordPress open registration — Ensure Settings → General → Anyone can register is unchecked on all WordPress instances. This eliminates the unauthenticated-to-subscriber escalation path. Audit with WP-CLI: wp option get users_can_register (should return 0).
5. Deploy WAF rule for multipart filename injection — Add a ModSecurity or Cloudflare WAF rule that rejects multipart upload requests where the filename header contains ImageMagick argument flags (-write, -script, ephemeral:, msl:). This provides defense-in-depth even if the plugin isn't updated.

Run this on each WordPress host where WP Photo Album Plus may be installed. Requires read access to the WordPress installation directory. Execute as the web server user or root: sudo bash check_cve_2026_87909.sh /var/www/html

#!/usr/bin/env bash
# CVE-2026-87909 Checker — WP Photo Album Plus ImageMagick RCE
# Usage: bash check_cve_2026_87909.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

WP_PATH="${1:?Usage: $0 /path/to/wordpress}"
PLUGIN_DIR="$WP_PATH/wp-content/plugins/wp-photo-album-plus"

# Check if plugin is installed
if [ ! -d "$PLUGIN_DIR" ]; then
  echo "PATCHED — WP Photo Album Plus is not installed at $WP_PATH"
  exit 0
fi

# Extract version from readme.txt or the main plugin file
VERSION=""
if [ -f "$PLUGIN_DIR/wp-photo-album-plus.php" ]; then
  VERSION=$(grep -i 'Version:' "$PLUGIN_DIR/wp-photo-album-plus.php" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ] && [ -f "$PLUGIN_DIR/readme.txt" ]; then
  VERSION=$(grep -i 'Stable tag:' "$PLUGIN_DIR/readme.txt" | head -1 | sed 's/.*Stable tag:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine WP Photo Album Plus version"
  exit 2
fi

echo "Detected WP Photo Album Plus version: $VERSION"

# Compare version — vulnerable: <= 9.2.09.002, fixed: >= 9.3.x
# Use sort -V for version comparison
FIXED_VERSION="9.2.09.003"
if printf '%s\n%s' "$FIXED_VERSION" "$VERSION" | sort -V | head -1 | grep -qx "$FIXED_VERSION"; then
  echo "PATCHED — Version $VERSION is at or above the fix threshold"
  exit 0
else
  # Additional check: look for escapeshellarg in the vulnerable function
  if grep -rq 'escapeshellarg' "$PLUGIN_DIR/wppa-photo-files.php" 2>/dev/null || \
     grep -rq 'escapeshellarg' "$PLUGIN_DIR/wppa-functions.php" 2>/dev/null; then
    echo "PATCHED — Version $VERSION contains escapeshellarg fix in image processing code"
    exit 0
  fi
  echo "VULNERABLE — Version $VERSION is affected by CVE-2026-87909"
  echo "  Affected: all versions <= 9.2.09.002"
  echo "  Fix: update to 9.3.02.003 or later"
  echo "  Mitigate: disable ImageMagick in plugin settings"
  exit 1
fi

1. Wordfence Threat Intel — WP Photo Album Plus
2. Strix CVE-2026-87909 Analysis
3. OffSeq Threat Radar — CVE-2026-87909
4. GitHub Vuln Alert — CVE-2026-87909
5. WordPress.org — WP Photo Album Plus Plugin Page
6. WP Photo Album Plus ImageMagick Documentation
7. ImageTragick — ImageMagick Exploit Background
8. OpenCVE — WP Photo Album Plus Vulnerabilities