CVE-2026-87909: WP Photo Album Plus RCE Vulnerability

CVE-2026-87909 Overview

CVE-2026-87909 is a Remote Code Execution (RCE) vulnerability in the WP Photo Album Plus plugin for WordPress. The flaw resides in the wppa_image_magick function, which builds an ImageMagick command string using an attacker-controlled multipart upload filename. The plugin applies escapeshellcmd() to the full command rather than quoting individual arguments, allowing argument injection through spaces in the filename. Authenticated attackers with subscriber-level access or higher can execute arbitrary commands on the underlying server. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers with only subscriber privileges can achieve remote code execution on the WordPress host, leading to full site compromise.

Affected Products

WP Photo Album Plus plugin for WordPress (all versions prior to the fix)
WordPress sites permitting subscriber-level registration with the plugin active
Hosting environments where the WordPress process can invoke ImageMagick via exec()

Discovery Timeline

2026-09-19 - CVE-2026-87909 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-87909

Vulnerability Analysis

The WP Photo Album Plus plugin processes uploaded images by invoking ImageMagick through PHP's exec() function. The wppa_image_magick function concatenates the temporary uploaded file path into a shell command string. Before execution, the plugin wraps the entire command in escapeshellcmd(). This function escapes shell metacharacters such as ;, |, and backticks, but it does not treat spaces as dangerous. Spaces remain valid argument separators for the shell, which enables an attacker to inject additional ImageMagick command-line options by crafting a filename containing spaces.

While the plugin sanitizes filenames at the database layer, that sanitization is never applied to the physical temporary file path passed to ImageMagick. The disconnect between database-layer and filesystem-layer sanitization is the operative flaw.

Root Cause

The root cause is misuse of escapeshellcmd() as a substitute for per-argument quoting. Proper defense requires wrapping each argument with escapeshellarg() so that spaces and quotes are neutralized. Because the plugin escapes at the command level and skips the temporary path sanitization step entirely, attacker-supplied filenames flow directly into a shell context as separately parsed tokens.

Attack Vector

An authenticated attacker holding a subscriber account uploads a multipart image request in which the filename contains spaces followed by attacker-selected ImageMagick options. ImageMagick supports options such as delegate configuration and profile loading that can be abused to trigger command execution or file operations. Because escapeshellcmd() leaves the injected space-separated tokens intact, ImageMagick parses them as legitimate options and executes attacker-controlled logic. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Function Code for the vulnerable code paths.

Detection Methods for CVE-2026-87909

Indicators of Compromise

Web server access logs showing authenticated multipart uploads with unusual filenames containing spaces, quotes, or ImageMagick option flags such as -write, -set, or -profile.
Unexpected child processes spawned by the PHP-FPM or Apache worker, including convert, magick, sh, or bash invocations.
New or modified PHP files under the WordPress uploads directory, particularly within wp-content/uploads/wppa/.
Outbound network connections originating from the web server to previously unseen hosts following an image upload event.

Detection Strategies

Inspect POST requests to plugin upload endpoints for filenames containing whitespace or shell-relevant characters.
Monitor process ancestry for exec()-driven ImageMagick invocations whose command-line arguments diverge from expected image processing patterns.
Correlate WordPress user authentication events for subscriber accounts with subsequent file upload and process execution activity.

Monitoring Recommendations

Enable WordPress audit logging to capture uploads, user role changes, and plugin activity by low-privilege accounts.
Forward web server, PHP, and host process telemetry to a centralized analytics platform for cross-source correlation.
Alert on the WordPress PHP process spawning shell interpreters or writing executable content into the uploads directory.

How to Mitigate CVE-2026-87909

Immediate Actions Required

Update the WP Photo Album Plus plugin to the patched version released in the fix changeset 3701613.
Audit existing subscriber and higher-privileged accounts and remove unrecognized users created during the exposure window.
Review the WordPress uploads directory for unexpected PHP files or webshells and remove them.
Rotate WordPress administrator credentials and any secrets stored on the host if compromise is suspected.

Patch Information

The WP Photo Album Plus maintainers released a fix documented in the plugin repository. Refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Report for version details.

Workarounds

Disable the WP Photo Album Plus plugin until the patched version is deployed.
Restrict new user registration or elevate the minimum role required to interact with plugin upload endpoints.
Deploy a web application firewall rule blocking multipart uploads with filenames containing spaces or ImageMagick option flags.
Restrict the PHP process from executing shell interpreters using open_basedir, disable_functions, or AppArmor/SELinux profiles.

bash

# Example php.ini hardening to reduce exec-based RCE impact
disable_functions = exec,passthru,shell_exec,system,proc_open,popen
open_basedir = /var/www/html:/tmp