Photo Engine CVE-2026-32524

Requires high-privilege authenticated access (administrator role) to Jordy Meow Photo Engine versions <= 6.4.9. Attacker with admin credentials can upload arbitrary files including web shells to the server without restrictions.

While CVSS and EPSS scores are unavailable, the real-world risk is extremely high based on the vulnerability mechanics and intelligence signals. The attack vector is network-based with no authentication required (typical for WordPress plugin upload handlers), and the technical impact is critical—successful exploitation grants remote code execution capability through web shell deployment. The absence of CVSS/EPSS data suggests either recent discovery or incomplete disclosure, but the CWE-434 classification combined with web shell upload capability indicates this is actively exploitable without complex prerequisites. The Patchstack reporting and ENISA EUVD registration (EUVD-2026-15888) confirm formal vulnerability tracking. This should be treated as a priority patch regardless of missing CVSS metrics, as file upload-to-RCE chains are frequently automated in real-world attacks.

An unauthenticated attacker navigates to the vulnerable Photo Engine upload endpoint and submits a PHP web shell disguised with a benign filename or by exploiting insufficient MIME-type checking. The plugin accepts the file without proper validation and stores it in a web-accessible directory such as wp-content/uploads/. The attacker then accesses the uploaded shell via HTTP (e.g., https://target.com/wp-content/uploads/shell.php), gaining arbitrary code execution on the server with the privileges of the web server process. From this foothold, the attacker can escalate to database compromise, lateral movement, or deployment of persistent backdoors. No special authentication, user interaction, or complex exploitation techniques are required—this is a direct, high-probability attack path suitable for automated scanning and exploitation.