CVE-2026-107770 | tigroumeow Photo Engine Plugin up to 6.5.6 on WordPress Admin Guard profile.php __construct wplr_auth_token authorization

October 16, 2026 Yanac

A vulnerability has been found in tigroumeow Photo Engine Plugin up to 6.5.6 on WordPress and classified as critical. This affects the function Meow_WPLR_Sync_Admin::__construct of the file profile.php of the component Admin Guard. This manipulation of the argument wplr_auth_token causes authorization bypass.

This vulnerability is registered as CVE-2026-107770. Remote exploitation of the attack is possible. No exploit is available.VulDB Recent EntriesRead More