CVE-2026-107770: CWE-862 Missing Authorization in tigroumeow Photo Engine (Media Organizer & Lightroom)

CVE-2026-107770 describes an authorization bypass in the Photo Engine (Media Organizer & Lightroom) WordPress plugin affecting all versions up to and including 6.5.6. The vulnerability arises because the plugin does not properly verify user authorization before allowing actions such as deleting media attachments via wp_delete_attachment and uploading new attachments, which normally require elevated capabilities (upload_files or edit_others_posts). Additionally, a Subscriber-level user can retrieve their own wplr_auth_token from the profile.php page source because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out. This token is leaked into every admin page via wp_localize_script, enabling attackers to perform destructive actions on the /?wplr-sync-api endpoint without a cookie-based session.

An attacker can bypass authorization controls to permanently delete arbitrary media attachments and upload new media files on the affected WordPress site. This compromises the integrity and availability of media content. The vulnerability does not impact confidentiality but has high impact on integrity and availability. The attack requires only a Subscriber-level user or unauthenticated access to exploit the flaw via the leaked authentication token.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor advisory for updates. Until a patch is available, restrict Subscriber-level user access and consider disabling or limiting the Photo Engine plugin functionality. Avoid exposing admin pages to untrusted users to reduce token leakage risk.