CVE-2026-32524
Published: 25 March 2026
Summary
CVE-2026-32524 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific unrestricted file upload flaw in the WordPress plugin by identifying, reporting, and correcting the vulnerability.
Validates uploaded files to prevent dangerous types like web shells from being accepted by the photo engine upload function.
Deploys malicious code protection mechanisms to scan and block uploaded web shells during or after upload to the web server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) and deployment/execution of web shells for RCE (T1505.003).
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.
Deeper analysisAI
CVE-2026-32524 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Jordy Meow Photo Engine wplr-sync WordPress plugin. This flaw allows attackers to upload a web shell to the web server and affects all versions from n/a through 6.4.9. Published on 2026-03-25, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
The vulnerability can be exploited remotely by a high-privileged user, such as an authenticated administrator, with low attack complexity and no user interaction required. Successful exploitation changes the scope to the server (S:C), enabling high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), typically resulting in full remote code execution via the uploaded web shell.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wplr-sync/vulnerability/wordpress-photo-engine-plugin-6-4-9-arbitrary-file-upload-vulnerability?_s_id=cve provides details on this arbitrary file upload issue in the WordPress Photo Engine plugin version 6.4.9. Security practitioners should review it for recommended mitigations and patching instructions.
Details
- CWE(s)