Photo Engine CVE-2026-107770

Requires an attacker to obtain a valid wplr_auth_token. The documented path requires a Subscriber-level account (practical only where open user registration is enabled), who reads the token directly from the profile.php page source; the token leaks because the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to emit it on every admin page view. The token is then replayed in a cookie-less HTTP session against the /?wplr-sync-api endpoint to invoke wp_delete_attachment and upload actions. Limiting factors: all versions up to and including 6.5.6 are affected; impact is scoped to media attachments (destruction and unauthorized upload) rather than full site takeover; exploitation realistically depends on either self-registration being open or an existing low-trust account, which constrains fully anonymous exploitation despite the PR:N label.

Signals are mixed and point to a moderate, situational risk rather than a top-tier emergency. The vendor (Wordfence) CVSS 3.1 base score is 6.8 (Medium) with vector AV:N/AC:H/PR:N/UI:R, i.e. network-reachable, no privileges, but high attack complexity and required user interaction. No EPSS score, no CISA KEV listing, and no public POC were provided, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active or widespread exploitation. SSVC inputs (exploitation status, automatable, technical impact) were not supplied and cannot be asserted. A key internal conflict must be flagged: the vendor marks this PR:N/UI:R/AC:H, yet the only concrete exploitation path in the description is a Subscriber-level (authenticated, low-privilege) user reading their own wplr_auth_token from profile.php and then invoking destructive actions from a cookie-less session with no user interaction - that path reads more like PR:L/UI:N/AC:L. In other words, the headline 'unauthenticated attackers' claim is accurate for the final API call (the token works without a session cookie), but acquiring the token as documented requires at least a Subscriber account on a site with open registration. Technical impact is genuinely high for integrity and availability (permanent deletion of arbitrary media attachments and unauthorized uploads, I:H/A:H) with no confidentiality impact. Net: a real but not critical priority - prioritize on WordPress sites that allow self-registration or host low-trust users; deprioritize on locked-down single-admin installs.

On a WordPress site running Photo Engine (WP/LR Sync) <= 6.5.6 that permits self-registration, an attacker creates a Subscriber account, opens profile.php, and copies the wplr_auth_token leaked into the page source by wp_localize_script (because the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out). Using that token in a cookie-less HTTP request to /?wplr-sync-api, the attacker calls wp_delete_attachment to permanently destroy arbitrary media or uploads new files - actions that should require upload_files/edit_others_posts. No public exploit code was identified at the time of analysis, and the high attack complexity reflects the token-acquisition step rather than the trivial API call itself.