WP Photo Album Plus Security & Risk Analysis

The "wp-photo-album-plus" v9.1.09.003 plugin exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, several areas raise concerns. The static analysis reveals a small but unprotected REST API route, indicating a potential entry point for unauthenticated attacks. Additionally, the presence of dangerous functions like `exec` and `unserialize` within the code, even if not directly exploited in the analyzed flows, warrants caution as they can be vectors for more severe vulnerabilities if misused.

The plugin's vulnerability history is a significant red flag. With a total of 18 known CVEs, including 3 critical, 4 high, and 11 medium vulnerabilities, this indicates a recurring pattern of security weaknesses. The common vulnerability types, such as XSS, Code Injection, Unrestricted Uploads, Authorization Bypass, and SQL Injection, suggest a history of insecure input handling and insufficient access control. Although there are currently no unpatched CVEs, the sheer volume and severity of past issues suggest a codebase that has historically been prone to significant security flaws. The most recent vulnerability in 2026 further emphasizes the need for ongoing vigilance.

In conclusion, "wp-photo-album-plus" v9.1.09.003 has some strengths in its SQL handling and output escaping. However, the unprotected REST API endpoint, the presence of dangerous functions, and the extensive history of critical and high-severity vulnerabilities significantly detract from its overall security. Users should be aware that while the current version may not have unpatched CVEs, the historical track record suggests a higher inherent risk and potential for future undiscovered vulnerabilities.