CVE-2026-15344: WP Photo Album Plus SQLi Vulnerability

CVE-2026-15344 Overview

CVE-2026-15344 is a SQL injection vulnerability in the WP Photo Album Plus plugin for WordPress. The flaw affects all versions up to and including 9.2.04.002. The plugin fails to escape the user-supplied table parameter and does not properly prepare the underlying SQL query. Authenticated attackers with administrator-level access can append additional SQL queries to extract sensitive database contents. The vulnerable export-table endpoint also lacks a nonce check, allowing exploitation through Cross-Site Request Forgery (CSRF) if an administrator visits a malicious page. The issue is tracked under CWE-89 (SQL Injection).

Critical Impact
Authenticated administrators, or victims of CSRF, can inject arbitrary SQL into an export-table query and exfiltrate sensitive WordPress database records including user credentials and session data.

Affected Products

WP Photo Album Plus plugin for WordPress — all versions up to and including 9.2.04.002
WordPress sites where the plugin is installed and active
Administrator-accessible endpoints exposed by wppa-ajax.php (export-table action)

Discovery Timeline

2026-07-29 - CVE-2026-15344 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15344

Vulnerability Analysis

The vulnerability resides in the WP Photo Album Plus export functionality. The plugin accepts a table parameter from an authenticated request and incorporates it into a SQL statement that is executed against the WordPress database. Because the parameter is neither escaped nor passed through a prepared statement, an attacker can append additional SQL fragments to the intended query. The affected code paths are referenced in wppa-admin-functions.php (lines 887 and 899), wppa-ajax.php (line 4448), and wppa-input.php (line 399) of the plugin source, per the WordPress Plugin Repository.

Successful exploitation results in disclosure of arbitrary database contents. The CSRF vector broadens the attack surface because the export-table endpoint does not verify a WordPress nonce. An unauthenticated attacker can host a crafted page that, when visited by a logged-in administrator, forces the browser to submit the malicious request under the admin's session.

Root Cause

The root cause is insufficient input sanitization combined with missing query preparation. The table parameter is concatenated into a SQL statement rather than bound as a parameter through wpdb::prepare(). Additionally, the export-table action handler omits a check_admin_referer() or wp_verify_nonce() call, removing the CSRF safeguard that WordPress conventions expect for state-changing or privileged administrative actions.

Attack Vector

Exploitation requires either direct administrator access to the vulnerable endpoint or a CSRF chain that tricks an authenticated administrator into loading attacker-controlled content. An attacker submits a request to the plugin's AJAX handler with a table value crafted to break out of the intended identifier context and append a UNION SELECT or similar clause. The result of the injected query is exposed through the export flow, allowing data extraction from any table accessible to the WordPress database user.

Detailed vulnerability information is available in the Wordfence Vulnerability Report and the WordPress Changeset Details that introduce the fix.

Detection Methods for CVE-2026-15344

Indicators of Compromise

Requests to admin-ajax.php or plugin AJAX endpoints containing action= values tied to wppa export routines with unusual table parameter contents such as SQL keywords (UNION, SELECT, --, INFORMATION_SCHEMA).
Unexpected outbound responses containing rows from wp_users, wp_usermeta, or wp_options returned by export-table calls.
Administrator sessions initiating export-table requests immediately after visiting external or untrusted web pages, suggesting a CSRF trigger.

Detection Strategies

Enable WordPress and web application firewall (WAF) logging for all requests to WP Photo Album Plus endpoints and alert on SQL metacharacters in the table parameter.
Correlate HTTP referer headers with export-table requests to identify off-site origins consistent with CSRF exploitation.
Review MySQL general or slow query logs for anomalous queries referencing wp_users or joins outside the plugin's normal schema.

Monitoring Recommendations

Monitor for plugin versions at or below 9.2.04.002 across managed WordPress fleets using inventory tooling.
Alert on new or modified administrator accounts and password resets that follow suspicious export-table activity.
Track outbound data volume from WordPress hosts, as SQL injection exfiltration through export endpoints can produce oversized responses.

How to Mitigate CVE-2026-15344

Immediate Actions Required

Update WP Photo Album Plus to a version above 9.2.04.002 as soon as a patched release is available from the plugin repository.
Audit WordPress administrator accounts and rotate credentials for any account that may have been used to trigger the vulnerable endpoint.
Review database query logs and WordPress export activity for the presence of injection payloads dating back to plugin installation.

Patch Information

The plugin author addressed the issue in a subsequent release tracked in the WordPress Changeset Details. Administrators should upgrade through the WordPress plugin update mechanism and verify the installed version reports higher than 9.2.04.002.

Workarounds

Temporarily deactivate WP Photo Album Plus until the patched version can be deployed.
Restrict access to /wp-admin/ and admin-ajax.php by source IP address using a reverse proxy or WAF rule to limit CSRF exposure.
Deploy a WAF signature blocking SQL metacharacters in the table parameter of WP Photo Album Plus AJAX requests.
Enforce administrator use of dedicated browser sessions or profiles for WordPress administration to reduce CSRF risk from general browsing.

bash

# Example WAF rule (ModSecurity) blocking SQL keywords in the 'table' parameter
SecRule ARGS:table "@rx (?i)(union|select|insert|--|/\*|information_schema)" \
    "id:1015344,phase:2,deny,status:403,log,\
     msg:'CVE-2026-15344 WPPA SQLi attempt in table parameter'"