{"metadata": {"vulnerability": "CVE-2026-107770", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-08T19:22:16.311Z", "date_only": false, "value": "2026-10-08T19:22:16.311Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-107770", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T19:37:27Z", "date_only": false, "value": "2026-10-08T19:37:27.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-107770", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T17:49:22Z", "date_only": false, "value": "2026-10-15T17:49:22.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-107770", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T06:41:01.346Z", "date_only": false, "value": "2026-10-16T06:41:01.346Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-107770", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T06:41:01.346Z", "date_only": false, "value": "2026-10-16T06:41:01.346Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-107770", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T06:58:53.209Z", "date_only": false, "value": "2026-10-16T06:58:53.209924Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117449289406947238", "record": "CVE-2026-107770", "field": "creation_timestamp", "uuid": "6c59ad12-301e-4ccb-ba11-35a87bf8d70f", "content": "CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107770https://www.wordfence.com/threat-intel/vulnerabilities/id/2f32c361-9bb3-417b-a5a9-02e48bfa33b4?source=cvehttps://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L116https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L32https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L923https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L155https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L309https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L201https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L56https://plugins.trac.wordpress.org/changeset/3737477/wplr-synchttps://plugins.trac.wordpress.org/changeset/3737477/wplr-sync/trunk/classes/api.php#wordpress #tigroumeow #PhotoEngine(MediaOrganizer&Lightroom)#CVE_2026_107770#bot", "url": "https://infosec.exchange/users/cve/statuses/117449289406947238"}, {"timestamp": "2026-10-16T07:17:09Z", "date_only": false, "value": "2026-10-16T07:17:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-567Q-WWF7-9P59", "record": "GHSA-567Q-WWF7-9P59", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T07:17:09.253Z", "date_only": false, "value": "2026-10-16T07:17:09.253", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107770", "record": "FKIE_CVE-2026-107770", "field": "published"}, {"timestamp": "2026-10-16T09:30:26Z", "date_only": false, "value": "2026-10-16T09:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-567Q-WWF7-9P59", "record": "GHSA-567Q-WWF7-9P59", "field": "published"}, {"timestamp": "2026-10-16T09:30:26Z", "date_only": false, "value": "2026-10-16T09:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-567Q-WWF7-9P59", "record": "GHSA-567Q-WWF7-9P59", "field": "modified"}, {"timestamp": "2026-10-16T14:23:12.057Z", "date_only": false, "value": "2026-10-16T14:23:12.057643Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107770", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:23:12.057Z", "date_only": false, "value": "2026-10-16T14:23:12.057643Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107770", "record": "FKIE_CVE-2026-107770", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T14:23:26.406Z", "date_only": false, "value": "2026-10-16T14:23:26.406Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-107770", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:23:26.406Z", "date_only": false, "value": "2026-10-16T14:23:26.406Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107770", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:05.870Z", "date_only": false, "value": "2026-10-16T15:17:05.870", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107770", "record": "FKIE_CVE-2026-107770", "field": "lastModified"}]}