Is CVE-2026-107770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107770 being exploited in the wild.

How severe is CVE-2026-107770?

Medium severity, with a CVSS score of 6.8, published 16 October 2026.

Which products and versions are affected?

Meow Apps The Photo Engine (Media Organizer & Lightroom) up to and including 6.5.6.

Is there a fix for CVE-2026-107770?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107770 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107770?

Check whether you run Meow Apps The Photo Engine (Media Organizer & Lightroom) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107770: The Photo Engine authorization bypass in Media Organizer & Lightroom plugin

CVE-2026-107770 · Severity: medium · CVSS 6.8 · Published 2026-10-16

The Photo Engine plugin for WordPress (used for media library management and Lightroom integration) fails to properly verify user permissions, allowing attackers to delete arbitrary media files and upload new content without authorization. This could lead to website defacement, data loss, or malware injection via uploaded files.

Vendors: Meow Apps.

Quick answers

Is CVE-2026-107770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107770 being exploited in the wild.
How severe is CVE-2026-107770?: Medium severity, with a CVSS score of 6.8, published 16 October 2026.
Which products and versions are affected?: Meow Apps The Photo Engine (Media Organizer & Lightroom) up to and including 6.5.6.
Is there a fix for CVE-2026-107770?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107770 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107770?: Check whether you run Meow Apps The Photo Engine (Media Organizer & Lightroom) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin suffers from multiple authorization bypass issues: a disabled guard in the admin constructor causes wp_localize_script to leak authentication tokens to all admin pages, and the /?wplr-sync-api endpoint accepts authenticated requests without verifying user capabilities for destructive actions like wp_delete_attachment. Attackers can obtain a Subscriber-level wplr_auth_token from profile.php and use it in cookie-less HTTP sessions to invoke file deletion and upload operations that normally require upload_files or edit_others_posts capabilities.

Affected products

Meow Apps The Photo Engine (Media Organizer & Lightroom) up to and including 6.5.6

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.