This vulnerability in Jordy Meow Photo Engine's wplr-sync component allows an attacker with high privileges to upload files without proper restrictions on file types. This can lead to the upload of a web shell, which could be used to execute arbitrary code on the server, compromising the system. The vulnerability affects all versions up to 6.4.9. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation could result in full compromise of the affected web server, including unauthorized code execution, data disclosure, data modification, and service disruption. Given the ability to upload a web shell, attackers could maintain persistent access and control over the server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious uploads if possible. Avoid exposing the affected component to untrusted users. Follow Jordy Meow's official channels for updates on patches or mitigations.