CVE-2026-107770Published
Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107770 · Microsoft / collected KEV context
cve-program · CVE-2026-107770
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2f32c361-9bb3-417b-a5a9-02e48bfa33b4?source=cve
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L116
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L32
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L923
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L155
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L309
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L201
- https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L56
- https://plugins.trac.wordpress.org/changeset/3737477/wplr-sync
- https://plugins.trac.wordpress.org/changeset/3737477/wplr-sync/trunk/classes/api.php
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.