What is the CVSS score of CVE-2026-6147?

CVE-2026-6147 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of LightSync Pro are affected by CVE-2026-6147?

LightSync Pro WordPress plugin (versions ≤2.1.6) contains an arbitrary file upload vulnerability in its REST API that allows authenticated Author-level users to upload executable PHP files and…

How to fix or mitigate CVE-2026-6147?

Within 24 hours, inventory all WordPress installations running LightSync Pro 2.1.6 or earlier and disable the plugin on non-mission-critical sites. Within 7 days, restrict Author-level role assignment to a minimal set of trusted personnel, enable detailed logging of REST API calls to `wp-json/lightsync/*` endpoints, and audit recent file uploads for suspicious PHP or executable files. Within 30 days, evaluate replacement plugins with established security practices; if LightSync Pro remains in use, implement permanent server-level controls: configure the web server to prevent PHP execution in wp-content/uploads/ directories, block REST API access via WAF rules, and establish continuous monitoring of upload operations.

LightSync Pro CVE-2026-6147

EUVD-2026-53180 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-05 Wordfence

GHSA-3675-4vjh-249r

WordPress File Upload RCE Lightsync Pro Connect Sync Cloud Assets Lightroom Canva Figma Dropbox Shutterstock

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-exposed REST endpoint, low complexity, Author-level credential required (PR:L); full CIA impact from arbitrary PHP execution on the server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:48 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

HIGH 8.8

DescriptionCVE.org

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated rest_replace_media() REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).

Technical ContextAI

LightSync Pro is a WordPress plugin designed to synchronize and replace media assets sourced from cloud platforms including Lightroom, Canva, Figma, Dropbox, and Shutterstock (CPE: cpe:2.3:a:lightsyncpro:lightsync_pro_-_connect_&_sync_cloud_assets_|_lightroom,_canva,_figma,_dropbox_&_shutterstock:*:*:*:*:*:*:*:*). The vulnerable function rest_replace_media() - located at approximately line 6755 and 6814 of includes/admin/class-admin.php in the 2.0.1 tag, per WordPress Trac - is exposed as a REST API endpoint. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the function accepts user-supplied file content and stores it without checking the MIME type or file extension against an allowlist. WordPress core provides utility functions (e.g., wp_check_filetype_and_ext()) for this purpose, and their absence here is the structural defect. A fix was committed in WordPress Trac changeset 3507389 (diff against 3476495), indicating the validation logic was added upstream, but a formally released plugin version containing the fix is not confirmed in the provided data.

RemediationAI

Upstream fix available via WordPress Trac changeset 3507389 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3507389%40lightsyncpro%2Ftrunk&old=3476495%40lightsyncpro%2Ftrunk); a formally tagged plugin release version containing this fix was not confirmed in the available data - verify with the WordPress Plugin Directory and update to any version newer than 2.1.6 once a patched release is published. As a compensating control while awaiting the patch, administrators should restrict Author-level user registration if it is not operationally required, as this eliminates the low-privilege attack surface entirely. Alternatively, a WAF rule blocking file uploads containing PHP-executable extensions (.php, .phtml, .php5, etc.) to the REST endpoint rest_replace_media will block the most dangerous payloads, though this does not address the underlying validation gap. Disabling the LightSync Pro plugin entirely is the most reliable interim mitigation for environments where cloud sync functionality is not critical.