CVE-2026-111972

MediumCVSS 4.9

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The WordPress plugin Photo Engine (Media Organizer & Lightroom) before version 6.5.8 does not verify that a user is authorized to act on the targeted media attachment. Authenticated users with the author role and above can delete arbitrary attachments, including those uploaded by other users and administrators.

Risk Assessment

Low-privileged users can delete media files belonging to others, leading to data loss and disruption of the site.

Recommendation

Update the Photo Engine plugin to version 6.5.8 or later to enforce authorization checks on attachment operations.

Other vulnerabilities in Photo Engine (Media Organizer & Lightroom)

CVE-2026-111971Medium
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

Original NVD description (English source)

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS