CVE-2026-54829

{
  "id": "CVE-2026-54829",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T14:16:47.120",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection.\n\nThis issue affects WP Photo Album Plus: from n/a through 9.1.13.005."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales utilizados en un Comando SQL (’inyección SQL’) en Jacob N. Breetvelt WP Photo Album Plus permite inyección SQL a ciegas.\n\nEste problema afecta a WP Photo Album Plus: desde n/a hasta 9.1.13.005."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Jacob N. Breetvelt",
          "product": "WP Photo Album Plus",
          "defaultStatus": "unaffected",
          "collectionURL": "https://wordpress.org/plugins",
          "packageName": "wp-photo-album-plus",
          "versions": [
            {
              "version": "n/a",
              "lessThanOrEqual": "9.1.13.005",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "9.2.01.001",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T13:57:44.197731Z",
          "id": "CVE-2026-54829",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-1-13-005-sql-injection-vulnerability?_s_id=cve",
      "source": "[email protected]"
    }
  ]
}