{"id":"CVE-2026-111972","kind":"vulnerability","aliases":["CVE-2026-111972"],"related":[],"title":"Photo Engine WordPress plugin lets authors delete any user's media attachments","description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not check whether a user may act on a given media attachment. An authenticated user with the author role or higher can delete media files uploaded by other users, including administrators.","severity":"medium","cvss":4.9,"epss":0.00193,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-author-role-users","plugin-6.5.8-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Photo Engine (Media Organizer & Lightroom) plugin in the WordPress admin plugins list; it is affected below `6.5.8`\n- Review who holds the author role or higher on the site, since those accounts can exercise the flaw","fix":"- Update the Photo Engine (Media Organizer & Lightroom) plugin to `6.5.8` or later\n- Until updated, restrict author and higher accounts to trusted users","status":"open","published_at":"2026-10-22T06:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:31:07+00:00","updated_at":"2026-10-25T04:31:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:31:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Photo Engine (Media Organizer & Lightroom) plugin to `6.5.8` or later\n- Until updated, restrict author and higher accounts to trusted users","reach":"internet","title":"Photo Engine WordPress plugin lets authors delete any user's media attachments","impact":"medium","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not check whether a user may act on a given media attachment. An authenticated user with the author role or higher can delete media files uploaded by other users, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authors can delete any user's media files, including administrators' uploads","analyst_note":"","how_to_check":"- Check the installed version of the Photo Engine (Media Organizer & Lightroom) plugin in the WordPress admin plugins list; it is affected below `6.5.8`\n- Review who holds the author role or higher on the site, since those accounts can exercise the flaw","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-6.5.8-or-later","no-author-role-users"],"who_is_affected":"Sites running the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 with user accounts at the author role or above. The risk is loss of media attachments belonging to other users, not code execution. Sites without this plugin, or with only subscriber and contributor accounts, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3365,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111972':15A,18A '-2026':14A,17A '6.5.8':36B,78C 'act':44B,88C 'administr':68B,115C 'allow':94C 'arbitrari':105C 'attach':12A,49B,93C,107C 'authent':51B,95C 'author':6A,55B,99C 'authoris':86C 'check':39B 'cve':13A,16A 'delet':7A,60B,104C 'engin':2A,29B,71C 'file':62B 'given':47B 'higher':58B 'host':22B 'includ':67B,108C 'let':5A 'lightroom':32B,74C 'may':43B 'media':11A,30B,48B,61B,72C,92C,106C 'organ':31B,73C 'packag':19B 'photo':1A,28B,70C 'plugin':4A,26B,34B,76C 'role':56B,100C 'self':21B 'self-host':20B 'target':91C 'upload':63B,110C 'user':9A,42B,52B,66B,84C,96C,113C 'verifi':81C 'whether':40B 'wordpress':3A,23B,25B,33B,75C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 with user accounts at the author role or above. The risk is loss of media attachments belonging to other users, not code execution. Sites without this plugin, or with only subscriber and contributor accounts, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111972","severity":null,"published_at":"2026-10-22T06:17:14+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111972","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111972","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}