{"id":"CVE-2026-107770","kind":"vulnerability","aliases":["CVE-2026-107770"],"related":[],"title":"WordPress Photo Engine plugin lets unauthenticated users delete media attachments","description":"The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin up to and including 6.5.6 fails to check authorization on its sync API. An unauthenticated attacker can permanently delete media attachments and upload new ones, and a Subscriber-level user can take a token from the admin page source to reach the same destructive actions.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library","package","self-hosted","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of the Photo Engine (Media Organizer & Lightroom) plugin in WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Look for the `/?wplr-sync-api` endpoint responding on the site\n- Check whether the Meow_WPLR_Sync_Admin admin guard is commented out in the plugin source","fix":"- Update the Photo Engine (Media Organizer & Lightroom) plugin to a version later than `6.5.6`; the sources do not name the fixed version\n- Until updated, deactivate the plugin or block the `/?wplr-sync-api` endpoint at the web server\n- Restore deleted media from backups if the endpoint was reachable","status":"open","published_at":"2026-10-16T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:45:16+00:00","updated_at":"2026-10-25T03:45:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:45:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Photo Engine (Media Organizer & Lightroom) plugin to a version later than `6.5.6`; the sources do not name the fixed version\n- Until updated, deactivate the plugin or block the `/?wplr-sync-api` endpoint at the web server\n- Restore deleted media from backups if the endpoint was reachable","reach":"internet","title":"WordPress Photo Engine plugin lets unauthenticated users delete media attachments","impact":"medium","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin up to and including 6.5.6 fails to check authorization on its sync API. An unauthenticated attacker can permanently delete media attachments and upload new ones, and a Subscriber-level user can take a token from the admin page source to reach the same destructive actions.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","media-library","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers permanently delete media and upload new attachments without logging in","analyst_note":"Confirm the fixed plugin version and whether the endpoint is exposed by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107770 for the vendor fix.","how_to_check":"- Check the installed version of the Photo Engine (Media Organizer & Lightroom) plugin in WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Look for the `/?wplr-sync-api` endpoint responding on the site\n- Check whether the Meow_WPLR_Sync_Admin admin guard is commented out in the plugin source","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"WordPress sites with the Photo Engine (Media Organizer & Lightroom) plugin installed at version 6.5.6 or earlier are exposed. Any site with that plugin active and the sync API reachable from the internet is at risk, including those where anonymous users can reach the endpoint; the Subscriber-level path also needs only a normal user account. Sites without the plugin, or with it removed, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000755,"input_tokens":3519,"output_tokens":806,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107770':13A,16A '-2026':12A,15A '6.5.6':40B,103C 'action':81B,121C,146C,218C 'admin':73B,177C,184C,199C 'api':48B,224C 'arbitrari':132C 'attach':10A,56B,134C,138C,142C 'attack':51B,128C 'auth':167C 'author':44B,94C,117C 'bypass':95C 'capabl':156C 'caus':189C 'check':43B 'comment':187C 'construct':185C 'cooki':211C 'cookie-less':210C 'cve':11A,14A 'delet':8A,54B,131C,137C 'destruct':80B,217C 'direct':169C 'due':106C 'edit':153C 'endpoint':225C 'engin':3A,30B,84C 'everi':198C 'fail':41B 'file':151C 'guard':179C 'host':23B 'http':213C 'includ':39B,102C 'invok':216C 'leak':194C 'less':212C 'let':5A 'level':65B,160C 'librari':19B 'lightroom':33B,87C 'local':191C 'make':123C 'media':9A,18B,31B,55B,85C,133C 'media-librari':17B 'meow':181C 'new':59B,141C 'obtain':163C 'one':60B 'organ':32B,86C 'other':154C 'packag':20B 'page':74B,173C,200C 'perform':119C 'perman':53B,130C 'photo':2A,29B,83C 'plugin':4A,27B,35B,88C,109C 'possibl':125C 'post':155C 'profile.php':172C 'proper':111C 'reach':77B 'requir':148C 'screen':178C 'script':192C 'self':22B 'self-host':21B 'session':214C 'site':145C 'sourc':75B,174C 'subscrib':64B,159C 'subscriber-level':63B,158C 'sync':47B,183C,223C 'take':68B 'token':70B,168C,196C,203C 'unauthent':6A,50B,127C 'upload':58B,140C,150C 'use':207C 'user':7A,66B,115C,161C 'verifi':112C 'version':98C 'via':135C 'view':201C 'vulner':92C 'wordpress':1A,24B,34B,90C 'wp':26B,136C,190C 'wp-plugin':25B 'wplr':166C,182C,222C 'wplr-sync-api':221C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Photo Engine (Media Organizer & Lightroom) plugin installed at version 6.5.6 or earlier are exposed. Any site with that plugin active and the sync API reachable from the internet is at risk, including those where anonymous users can reach the endpoint; the Subscriber-level path also needs only a normal user account. Sites without the plugin, or with it removed, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107770","severity":null,"published_at":"2026-10-16T07:17:09+00:00","modified_at":"2026-10-16T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}