The Photo Engine plugin for WordPress contains an authorization bypass in the /?wplr-sync-api endpoint. The flaw allows an unauthenticated attacker to delete any media attachment and to upload new attachments. Since the delete and upload actions require higher‑capability roles such as edit_others_posts or upload_files, the vulnerability effectively grants a low‑privilege user far‑reaching destructive power. An attacker can cause data loss by permanently deleting images, videos, or other media assets, and may also introduce malicious files into the wp‑content/uploads directory that could be accessed or executed by the web server.

WordPress sites running Photo Engine (Media Organizer & Lightroom) plugin up to and including version 6.5.6 are vulnerable. The issue exists in all releases until 6.5.6 and affects the plugin’s API layer that is accessible via the /?wplr-sync-api path. Site administrators should identify whether the plugin is installed and the major version. Updating to version later than 6.5.6 will resolve the token leakage detection and refactor the delete/sync actions. In environments where the plugin is managed manually, any WordPress installation containing the affected code files listed in the references should be considered compromised.

The CVSS score of 6.8 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests that the vulnerability has not yet been widely exploited. However, the flaw requires no special conditions: a remote unauthenticated user can obtain the authentication token from the profile page because the admin guard is commented out, and then call the API endpoint without a session cookie. This straightforward attack path, coupled with the plugin’s permissive capabilities, makes exploitation trivial from a technical standpoint. Sites should treat the vulnerability as significant, given the potential for widespread media deletion and unauthorized file upload, and should act to remediate immediately.