CVE-2026-107770: Photo Engine (Media Organizer & Lightroom) 0 through 6.5.6

Affected technology

Photo Engine (Media Organizer & Lightroom) · 0 through 6.5.6
tigroumeow

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint. Vendor/CNA’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality impact as none; integrity and availability impact as high.