CVE-2026-6147

Name of the Vulnerable Software and Affected Versions LightSync Pro versions prior to 2.1.7

Description The LightSync Pro plugin for WordPress allows authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This issue occurs because the rest replace media() function fails to validate file types, which could lead to remote code execution.

Recommendations Update the plugin to a version later than 2.1.6. As a temporary workaround, restrict access to the rest replace media() function to minimize the risk of exploitation.