Authorization Bypass Vulnerability in Photo Engine Plugin for WordPress

CVE-2026-107770

What is CVE-2026-107770?

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress has a vulnerability that allows unauthorized users to delete arbitrary media attachments and upload new ones. This occurs due to insufficient authorization checks, particularly in versions up to and including 6.5.6. An attacker can exploit a flaw in the handling of tokens, which affects the security of the wp_localize_script function, to perform destructive actions on the site. Specifically, Subscriber-level users can extract their authentication token from exposed scripts, enabling them to bypass normal protections and execute harmful operations via the /?wplr-sync-api endpoint.

References