Photo Engine Media Organizer Lightroom
Monthly
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.