CVE-2026-111972
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
| Vendor | unknown |
| Product | photo engine (media organizer & lightroom) |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown photo engine (media organizer & lightroom)
Be the first to know when new unknown vulnerabilities affecting unknown photo engine (media organizer & lightroom) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Photo Engine (Media Organizer & Lightroom)
0 < 6.5.8
References
Credits
Mahammad Mammadov WPScan