CVE-2026-107770

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions ¦6.5.6 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to permanently delete arbitrary media attachments using wp_delete_attach...

CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770: Missing Authorization

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

PT-2026-115488

Name of the Vulnerable Software and Affected Versions The Photo Engine Media Organizer & Lightroom versions prior to 6.5.7 Description An authorization bypass exists because the plugin fails to properly verify user permissions before performing actions. Unauthenticated attackers can permanently...

CVE-2026-32524

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

EUVD-2026-15888

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

CVE-2026-32524

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

CVE-2026-32524

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

CVE-2026-32524 WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

CVE-2026-32524

CVE-2026-32524 : WordPress Photo Engine (WPLR-Sync) suffers an Unrestricted Upload of File with Dangerous Type vulnerability. The Wordfence report confirms the issue as an Arbitrary File Upload in Photo Engine (Media Organizer & Lightroom) &lt;= 6.4.9, exploitable by authenticated users with Auth...

PT-2026-28038

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through = 6.4.9...

CVE-2025-54672: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/a through = 6.4.3...