WP Photo Album Plus Unauthenticated SQL Injection — CVE-2026-6379

Metadata

Affected Target

Summary

WP Photo Album Plus’s wppa_get_photos() function (in wppa-functions.php) parses the wppa-supersearch request parameter as a comma-separated value list. When the search “type” is o (Owner), the resulting DATA field is concatenated directly into a SQL query string without escaping or use of $wpdb->prepare(), allowing an unauthenticated attacker to break out of the quoted string and inject arbitrary SQL. Because the query’s result rows are never echoed back to the client, the included PoC exploits this as a time-based blind SQL injection (using SLEEP()), and can enumerate database contents byte-by-byte, including extracting the WordPress admin’s password hash from wp_users.user_pass. A second, related sink in the plugin’s calendar branch (wppa-calendar=exifdtm) is exploitable the same way and was patched in the same commit.

Vulnerability Details

Root Cause

wppa_get_photos() builds $query = "SELECT id FROM $wpdb->wppa_photos WHERE owner = '" . $data . "' AND album > 0 ORDER BY $order"; where $data comes directly from the attacker-supplied wppa-supersearch parameter’s 4th CSV field. No quoting or parameterization is applied to this case (case 'o'), unlike sibling cases 'i'/'e' which correctly use $wpdb->prepare(). A companion sink in the calendar/date-search branch builds WHERE exifdtm LIKE '<wp_strip_all_tags($caldate)>%', and wp_strip_all_tags() strips HTML but does not escape SQL, leaving it equally injectable.

Attack Vector

1. Identify a public WordPress page hosting a [wppa] (or similar) gallery shortcode — this requires no authentication.
2. Determine the shortcode’s occurrence index (wppa-occur=N, N=1 for the first [wppa] block on the page) — the plugin only routes URL parameters into the vulnerable function when this matches.
3. Send GET /?page_id=<id>&wppa-occur=1&wppa-supersearch=,o,,x' OR (SELECT 1 FROM (SELECT(SLEEP(5)))A)-- - — a vulnerable target delays its response by ~5 seconds; a patched target responds in under 1 second.
4. Use the same technique with IF(ASCII(SUBSTR((SELECT user_pass FROM wp_users LIMIT 1),N,1))>X, SLEEP(3), 0) conditions, iterated byte-by-byte, to extract the WordPress admin’s phpass password hash for offline cracking.
5. The included pocs/exploit.py automates all of this via --mode probe, --mode probe-calendar, --mode version, and --mode hash.

Impact

Full unauthenticated read access to the WordPress database is possible, including recovery of the administrator’s password hash, session/API secrets, and any other stored data reachable through blind boolean/time-based extraction — leading to full site compromise via credential cracking or direct data theft.

Environment / Lab Setup

Target:   WordPress 6.5 + MySQL 8 + WP Photo Album Plus 9.1.10.011, deployed via lab/docker-compose.yml
Attacker: Python 3, curl; no special tooling required beyond the provided exploit.py

Proof of Concept

PoC Script

See pocs/exploit.py in this folder (lab bring-up via lab/setup.sh and lab/docker-compose.yml).

1
2
3
4
5

cd lab && ./setup.sh
python3 ../pocs/exploit.py "http://<host>:8080/?page_id=<id>" --mode probe
python3 ../pocs/exploit.py "http://<host>:8080/?page_id=<id>" --mode probe-calendar
python3 ../pocs/exploit.py "http://<host>:8080/?page_id=<id>" --mode version
python3 ../pocs/exploit.py "http://<host>:8080/?page_id=<id>" --mode hash

The script performs time-based blind SQLi probes against both the owner (case 'o') and calendar (exifdtm) sinks, fingerprints the plugin version, and (in hash mode) extracts the WordPress admin password hash one byte at a time using conditional SLEEP() payloads. pocs/test_oracle.sh runs an end-to-end integration test against the lab.

Detection & Indicators of Compromise

Example suspicious access-log entry:
GET /?page_id=2&wppa-occur=1&wppa-supersearch=,o,,x%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))A)--%20- HTTP/1.1

Signs of compromise:

• wppa-supersearch= or wppa-calendar=/wppa-caldate= parameters containing a URL-encoded single quote (%27), SLEEP(, BENCHMARK(, IF(, UNION, SELECT, or -- in access logs.
• Anomalously slow response times (several seconds) for gallery pages with no legitimate reason for delay.
• MySQL general_log entries showing injected OR (SELECT ... SLEEP ...) fragments in queries against wp_wppa_photos.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/dinosn/cve-2026-6379 on 2026-07-05.