CVE-2026-32524: Jordy Meow Photo Engine wplr-sync Unrestricted File Upload (Web Shell)

Overview

CVE-2026-32524 is classified as CWE-434, Unrestricted Upload of File with Dangerous Type. The record places it in the wplr-sync component of Jordy Meow's Photo Engine and states that it allows a web shell to be uploaded to a web server. Details are taken from the Patchstack advisory and the NVD entry.

Impact

• A web shell placed on a web server can give a remote party persistent command-style control over the hosting environment, depending on how the server is configured.
• The CNA scored the issue 9.1 (critical) under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. That vector indicates network reach, low complexity, high privileges required, scope change and high impact on confidentiality, integrity and availability.
• The PR:H component means the score assumes an attacker already holds high privileges. How much real exposure exists depends on who can reach the vulnerable upload function on a given site.

Affected products and versions

The record describes the affected range as from n/a through and including 6.4.9. The lower bound is not stated, and the structured affected list is empty, so the exact set of vulnerable builds should be confirmed with the vendor or the Patchstack page.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is reported there. No confirmed exploitation appears in the sources consulted. The EPSS probability is low (about 0.5 percent), which is a statistical estimate of exploitation likelihood and not evidence that exploitation has occurred.

Remediation and mitigation

• The record contains no fixed version. Check the vendor and the Patchstack page for a patched release and apply it as soon as it is available.
• If no fix is confirmed, consider deactivating the wplr-sync component until a patched version is verified.
• Restrict who can use upload features, and remove unused accounts with upload rights.
• Configure the web server to prevent script execution in upload directories, which limits the effect of a dropped web shell.
• Review the site for recently added executable or script files, and rotate credentials if a compromise is suspected.

Detection guidance

• Use file integrity monitoring on upload and plugin directories to alert on new script or executable files.
• Review web server logs for unexpected requests to newly created files in upload paths, and for unusual activity around the plugin's endpoints.
• Compare the plugin's files against a known clean copy from a trusted source.

Limitations of the available information

• No fixed version, patch, or vendor remediation statement is present in the record.
• The lower bound of the affected range is given as n/a.
• The affected and fixes lists are empty, and no SSVC data is present.
• Only one advisory reference (Patchstack) is available in the record, so independent technical details are limited.
• The EPSS date field should be verified before relying on that value.

Frequently asked questions

What is CVE-2026-32524?

It is an unrestricted file upload weakness (CWE-434) in the wplr-sync component of Jordy Meow's Photo Engine, which the record says allows a web shell to be uploaded to a web server.

Which versions are affected?

The record lists versions from n/a through and including 6.4.9. The lower bound is not specified, so confirm the exact range with the vendor or Patchstack.

Is there a fix?

The record does not list a fixed version. Check the vendor and the Patchstack advisory for a patched release, and consider deactivating the component if no fix is confirmed.

Is it being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.