WP Photo Album Plus SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the WP Photo Album Plus WordPress plugin, affecting versions prior to 9.1.11.001. The vulnerability arises because the plugin fails to properly sanitize and escape the 'wppa-supersearch' parameter before incorporating it into a SQL query. This oversight allows unauthenticated users to execute SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the WordPress site.

Remediation

Users are advised to update the WP Photo Album Plus WordPress plugin to version 9.1.11.001 or later.