CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-32524

WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability

Status: Published
Published: 2026-03-25
Updated: 2026-04-29
Assigning organization: Patchstack

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jordy Meow Photo Engine

Default version status: unaffected

n/a to ≤ <= 6.4.9affected

References

https://patchstack.com/database/Wordpress/Plugin/wplr-sync/vulnerability/wordpress-photo-engine-plugin-6-4-9-arbitrary-file-upload-vulnerability?_s_id=cve ↗