CVE-2025-54672: Photo Engine wplr-sync CSRF Vulnerability

CVE-2025-54672 Overview

CVE-2025-54672 is a Cross-Site Request Forgery (CSRF) vulnerability in the Jordy Meow Photo Engine WordPress plugin, specifically in the wplr-sync component. The flaw affects all Photo Engine versions up to and including 6.4.3. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing requests to the target site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation lets an attacker perform unauthorized actions on behalf of an authenticated Photo Engine user through a forged request, potentially modifying plugin state or synced photo data.

Affected Products

Jordy Meow Photo Engine (wplr-sync) WordPress plugin versions through 6.4.3
WordPress installations with Photo Engine <= 6.4.3 installed and active
Sites relying on the wplr-sync component for Lightroom-to-WordPress synchronization

Discovery Timeline

2025-08-14 - CVE-2025-54672 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54672

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protection in the wplr-sync request handlers of the Photo Engine plugin. WordPress provides nonce-based token validation through wp_nonce_field() and check_admin_referer(), but the affected endpoints do not enforce these checks for state-changing operations. As a result, requests submitted from an external origin are processed as though they originated from a legitimate user session.

Exploitation requires user interaction, meaning a logged-in Photo Engine user must visit an attacker-controlled page or click a crafted link. The attack traverses the network and does not require any prior privileges on the target site. The impact is limited to integrity: an attacker cannot directly read data or crash the site, but can trigger unauthorized modifications tied to the victim's session.

With an EPSS score of 0.144%, active exploitation probability is low, and no public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is the absence of a validated anti-CSRF token on wplr-sync action handlers. WordPress plugins are expected to call wp_verify_nonce() or check_ajax_referer() before executing privileged actions. When these checks are missing, the browser's automatic inclusion of authentication cookies allows cross-origin requests to succeed.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form or a hidden image tag pointing at a vulnerable wplr-sync endpoint on the target WordPress site. When an authenticated Photo Engine user loads the attacker page, the browser attaches the WordPress session cookies to the outbound request, and the server executes the action under the victim's identity. Delivery typically occurs through phishing emails, malicious advertising, or comment injection on trusted forums.

The vulnerability is described in prose only, as no verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-54672

Indicators of Compromise

Unexpected changes to Photo Engine plugin settings or synced media without a corresponding administrator action in the WordPress audit log
HTTP POST or GET requests to wplr-sync endpoints containing an external Referer header that does not match the site's own domain
Access log entries showing wplr-sync actions immediately following outbound clicks to unknown domains from authenticated sessions

Detection Strategies

Inspect WordPress access logs for requests to admin-ajax.php or plugin routes referencing wplr-sync actions that lack a valid _wpnonce parameter
Correlate authenticated user activity with off-site Referer values to identify forged submissions
Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to Photo Engine endpoints missing a nonce token

Monitoring Recommendations

Enable a WordPress activity logging plugin to record all plugin configuration and content changes with user attribution
Monitor for anomalous session behavior where administrators appear to trigger plugin actions shortly after browsing external sites
Alert on unusual spikes of requests to wplr-sync handlers from a single authenticated session

How to Mitigate CVE-2025-54672

Immediate Actions Required

Update Jordy Meow Photo Engine to a version later than 6.4.3 once the vendor publishes a patched release
Audit administrator and editor accounts for recent unexpected plugin configuration or synchronization changes
Instruct privileged WordPress users to log out of the admin panel when browsing untrusted sites

Patch Information

At the time of publication, users should consult the Patchstack advisory for Photo Engine for the latest fixed-version guidance. Apply the vendor's official update as soon as it becomes available through the WordPress plugin repository.

Workarounds

Temporarily deactivate the Photo Engine plugin until a patched release is installed
Restrict access to /wp-admin/ using IP allowlists at the web server or WAF layer to reduce exposure to forged requests
Enforce SameSite cookie attributes (SameSite=Lax or Strict) on WordPress session cookies to limit cross-origin cookie transmission

bash

# Example nginx configuration to restrict wp-admin access by IP
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ /index.php?$args;
}