The vulnerability allows arbitrary files, including executable web shells, to be uploaded through the Photo Engine plugin’s upload interface. Once a malicious file is stored on the server, the attacker can execute code with the privileges of the web application, compromising confidentiality, integrity, and availability of the affected site.

All installations of Jordy Meow Photo Engine (wplr-sync) up to and including version 6.4.9 are exposed. No lower bound is documented, meaning every instance running a version at or below 6.4.9 is considered vulnerable.

The base score of 9.1 signals critical severity, and the exploit probability is reported to be below 1%. The vulnerability is not listed in the known exploited vulnerabilities catalog. The likely attack vector is remote, via the plugin’s upload functionality; an attacker with web access can upload a malicious file without the need for privileged authentication, after which remote code execution follows.