Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107770 · Microsoft / collected KEV context

cve-program · CVE-2026-107770

• https://www.wordfence.com/threat-intel/vulnerabilities/id/2f32c361-9bb3-417b-a5a9-02e48bfa33b4?source=cve
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L116
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L32
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L923
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L155
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L309
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L201
• https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L56
• https://plugins.trac.wordpress.org/changeset/3737477/wplr-sync
• https://plugins.trac.wordpress.org/changeset/3737477/wplr-sync/trunk/classes/api.php

No related operational record is retained in the current change model.