CVE-2026-6147
Received Received - Intake

Arbitrary File Upload in LightSync Pro WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-6147
EUVD
EUVD-2026-53180

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lightsync pro to 2.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LightSync Pro WordPress plugin has a flaw in its file upload function that allows authenticated users with Author-level access or higher to upload arbitrary files without proper validation. This can lead to remote code execution on the server.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially in the LightSync Pro plugin folder. Look for unexpected PHP or executable files. Review server logs for suspicious activity from Author-level users.

Impact Analysis

An attacker could exploit this to upload malicious files to your server, potentially gaining control over your website or stealing sensitive data. This requires only Author-level access, which is a common user role.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Compliance may be compromised if exploited.

Mitigation Strategies

Update the LightSync Pro plugin to the latest version. Remove the plugin if unused. Restrict file upload permissions and monitor for unauthorized uploads. Consider disabling Author-level access temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart