Arbitrary File Upload Vulnerability in LightSync Pro Plugin for WordPress

The LightSync Pro plugin for WordPress is susceptible to an arbitrary file upload vulnerability tracked as CVE-2026-6147. This flaw stems from a lack of server-side file type validation within the rest_replace_media() function. Authenticated attackers holding Author-level access or higher can leverage this endpoint to upload arbitrary files to the WordPress server. This capability bypasses intended security controls, allowing for the potential upload of malicious PHP webshells or other executable scripts, which can lead to complete remote code execution (RCE) on the underlying hosting infrastructure. This vulnerability affects all versions of the LightSync Pro plugin up to and including version 2.1.6.

Attack Chain

1. Attacker gains or creates an account with Author-level privileges on the target WordPress site.
2. Attacker identifies the use of the LightSync Pro plugin version 2.1.6 or earlier on the target server.
3. Attacker crafts a malicious payload (e.g., a PHP webshell) to be uploaded via the plugin.
4. Attacker sends a specially crafted HTTP POST request to the affected rest_replace_media() API endpoint.
5. The plugin fails to validate the file extension or MIME type of the uploaded content.
6. The malicious file is stored on the web server filesystem at a predictable or identifiable location.
7. Attacker triggers the execution of the uploaded script via a direct HTTP GET request to the file path.
8. Attacker achieves remote code execution, enabling system-level commands or further post-exploitation activities.

Impact

Successful exploitation of CVE-2026-6147 allows an authenticated attacker to execute arbitrary code on the web server, potentially leading to full site compromise, exfiltration of sensitive database content, or further propagation within the network. With a CVSS v3.1 score of 8.8, this vulnerability represents a high-risk vector for WordPress environments relying on this plugin for media synchronization.

Recommendation

• Immediately update the LightSync Pro plugin to the latest version available (post-2.1.6).
• Review all media upload directories for unauthorized files, particularly those with .php extensions, using an integrity monitoring tool.
• Audit WordPress user roles to ensure only trusted accounts maintain Author-level access or higher.
• Deploy web application firewall (WAF) rules to restrict non-image file types from being processed by the REST API endpoints associated with the LightSync Pro plugin.