CVE-2026-32524
Unrestricted File Upload in Jordy Meow Photo Engine Enables Web Shell
Publication date: 2026-03-25
Last updated on: 2026-03-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jordy_meow | photo_engine | to 6.4.9 (inc) |
| jordy_meow | photo_engine | From 6.4.9|end_including=6.4.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to upload and execute malicious files on a web server, potentially leading to unauthorized access and data breaches.
Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data.
Failure to prevent exploitation of this vulnerability could result in violations of these regulations due to compromised data confidentiality and integrity.
Can you explain this vulnerability to me?
CVE-2026-32524 is an Arbitrary File Upload vulnerability in the WordPress Photo Engine Plugin (wplr-sync) versions up to and including 6.4.9.
This vulnerability allows a malicious actor with author or developer privileges to upload arbitrary files, including dangerous files such as web shells, to a website.
Once uploaded, these malicious files can be executed on the web server, potentially allowing the attacker to gain unauthorized access and control.
The vulnerability is classified under OWASP Top 10 category A3: Injection and specifically as an Arbitrary File Upload flaw.
It has a high CVSS score of 9.1, indicating a significant security risk.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to your web server.
An attacker can upload and execute malicious backdoors or web shells, which can lead to full compromise of the affected website.
This can result in data theft, website defacement, disruption of services, or use of your server for further attacks.
Because the vulnerability can be exploited in mass attack campaigns, any website using the vulnerable plugin version is at risk regardless of its traffic or popularity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability allows a malicious actor with author or developer privileges to upload arbitrary files, including web shells, to a website. Detection can involve scanning the web server for unexpected or suspicious files, especially newly uploaded files with dangerous extensions or web shell signatures.
Specific commands are not provided in the available resources, but typical detection methods include:
- Searching the upload directories for recently added files with suspicious extensions (e.g., .php, .phtml, .php5) using commands like `find /path/to/uploads -type f -mtime -7` to find files modified in the last 7 days.
- Using file content scanning tools such as `grep` to look for common web shell signatures or PHP code patterns, e.g., `grep -r --include=*.php 'eval(' /path/to/uploads`.
- Monitoring web server logs for unusual POST requests or file upload activities targeting the Photo Engine plugin endpoints.
Since no explicit detection commands are provided in the resources, these general approaches are recommended.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate mitigation step is to update the WordPress Photo Engine Plugin to version 6.5.0 or later, where the vulnerability is patched.
Additionally, Patchstack provides an automatic mitigation rule that blocks exploitation attempts until the plugin is updated. Enabling this mitigation can help protect the site in the short term.
Patchstack users are also advised to enable auto-updates specifically for vulnerable plugins to ensure timely protection against this and similar vulnerabilities.