CVE-2026-120575 in Photo Engine Plugin
Summary
by MITRE • 11/03/2026
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in the Photo Engine plugin for WordPress represents a critical security flaw rooted in insufficient input sanitization and output escaping mechanisms within the application code. Specifically, this Stored Cross-Site Scripting issue affects all versions up to 6.5.7 through the hierarchy[].name parameter. The core technical failure lies in the lack of proper validation when processing user-supplied data destined for storage in the database, combined with a corresponding absence of escaping during subsequent output rendering. This architectural oversight allows malicious actors to inject arbitrary web scripts into persistent data structures, which are then executed by any user who views the affected pages. Such vulnerabilities fall under CWE-79, commonly known as Improper Neutralization of Input During Web Page Generation, and align with ATT&CK technique T1059.007, indicating script-based injection attacks that compromise client-side integrity.
The severity of this vulnerability is significantly amplified by the low privilege threshold required for exploitation. Typically, stored XSS vulnerabilities require higher-level administrative access to inject persistent malicious content into public-facing areas or shared resources. However, in this specific instance, the attack vector is accessible to users with subscriber-level permissions and above. This broad accessibility increases the risk surface considerably, as even new or low-privilege accounts can leverage this flaw to compromise other users within the same WordPress installation. The ability for subscribers to execute arbitrary JavaScript enables potential session hijacking, credential theft via keylogging scripts, defacement of user interfaces, or redirection to malicious external sites, thereby undermining the confidentiality and integrity of the web application environment.
The exploitability by subscriber-level accounts is facilitated by a specific authentication bypass mechanism within the plugin's API endpoint at /?wplr-sync-api. This endpoint authenticates requests solely based on the presence of a wplr_auth_token stored in user metadata, without performing any additional capability checks to verify if the requesting user has sufficient privileges for the action being performed. Furthermore, this token is inadvertently exposed to all users because it is included in localized script data that is outputted on every admin page due to a commented-out screen-condition guard. This design flaw ensures that even subscribers can retrieve their own authentication tokens and subsequently use them to interact with the vulnerable API endpoint, effectively bypassing intended access controls and enabling the injection of malicious payloads into the hierarchy[].name field.
To mitigate this vulnerability, immediate action is required to update the Photo Engine plugin to a version where these issues have been addressed by the developers. Until an official patch is available or deployed, administrators should consider disabling the plugin if it is not actively used for critical operations. Additionally, implementing strict input validation and output escaping in custom code modifications can help reduce risk, although relying on such workarounds is less secure than applying vendor-supplied fixes. Security monitoring tools should be configured to detect anomalous API calls originating from low-privilege accounts attempting to access synchronization endpoints. Regular audits of user capabilities and token exposure mechanisms are also recommended to prevent similar authentication bypasses in other plugins or custom themes, ensuring that the principle of least privilege is strictly enforced across all WordPress installations.