Live › vulnerability › CVE-2026-107770
Go to dashboardThe Photo Engine (Media Organizer & Lightroom) WordPress plugin up to and including 6.5.6 fails to check authorization on its sync API. An unauthenticated attacker can permanently delete media attachments and upload new ones, and a Subscriber-level user can take a token from the admin page source to reach the same destructive actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites with the Photo Engine (Media Organizer & Lightroom) plugin installed at version 6.5.6 or earlier are exposed. Any site with that plugin active and the sync API reachable from the internet is at risk, including those where anonymous users can reach the endpoint; the Subscriber-level path also needs only a normal user account. Sites without the plugin, or with it removed, are not affected.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version/?wplr-sync-api endpoint responding on the site6.5.6; the sources do not name the fixed version/?wplr-sync-api endpoint at the web serverEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-107770")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.