CVE-2026-6379 PUBLISHED

WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter

Assigner: WPScan
Reserved: 15.04.2026 Published: 18.05.2026 Updated: 18.05.2026

The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Product Status

Vendor Unknown
Product WP Photo Album Plus
Versions Default: unaffected
  • affected from 0 to 9.1.11.001 (excl.)

Credits

  • Daniel Púa - devploit finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE