Live › vulnerability › CVE-2026-111972
Go to dashboardThe Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not check whether a user may act on a given media attachment. An authenticated user with the author role or higher can delete media files uploaded by other users, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 with user accounts at the author role or above. The risk is loss of media attachments belonging to other users, not code execution. Sites without this plugin, or with only subscriber and contributor accounts, can skip it.
No product ranges from the sources yet.
6.5.86.5.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-111972")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.