CVE-2026-107770
Received Received - Intake

Authorization Bypass in Photo Engine WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-107770
EUVD
EUVD-2026-102787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tigroumeow Photo Engine (Media Organizer & Lightroom) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Photo Engine plugin for WordPress has an authorization bypass flaw in versions up to 6.5.6. It fails to verify user permissions properly, allowing unauthenticated attackers to delete media files and upload new ones. Attackers can exploit this by obtaining a leaked authentication token from the plugin's admin page source, which is exposed due to a commented-out security guard.

Detection Guidance

Check WordPress sites for the Photo Engine plugin version 6.5.6 or lower. Look for unauthorized media deletions or uploads in logs. Inspect admin pages for exposed wplr_auth_token in page source. Monitor /?wplr-sync-api endpoint requests for suspicious activity.

Impact Analysis

This vulnerability allows attackers to permanently delete media files on your WordPress site and upload malicious files. Even low-privilege users like Subscribers can exploit it to gain unauthorized access to destructive actions via the plugin's API endpoint.

Mitigation Strategies

Update the Photo Engine plugin to the latest version. Remove the plugin if unused. Restrict user roles to prevent unauthorized access. Review media permissions and logs for signs of exploitation. Consider disabling the /?wplr-sync-api endpoint temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart