← CVE Intelligence

CVE-2026-6379

WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter PUBLISHED

Description (CNA)

The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Affected (CNA)

Vendor / productVersions
Unknown / WP Photo Album Plusaffected 0 before 9.1.11.001

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.