---
id: "CVE-2026-111972"
kind: "vulnerability"
aliases: ["CVE-2026-111972"]
title: "Photo Engine WordPress plugin lets authors delete any user's media attachments"
severity: "medium"
cvss: 4.9
epss: 0.00193
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-author-role-users", "plugin-6.5.8-or-later", "plugin-not-installed"]
published_at: "2026-10-22T06:17:14+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:31:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111972", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111972", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Photo Engine WordPress plugin lets authors delete any user's media attachments

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not check whether a user may act on a given media attachment. An authenticated user with the author role or higher can delete media files uploaded by other users, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Photo Engine (Media Organizer & Lightroom) plugin in the WordPress admin plugins list; it is affected below `6.5.8`
- Review who holds the author role or higher on the site, since those accounts can exercise the flaw

## Fix

- Update the Photo Engine (Media Organizer & Lightroom) plugin to `6.5.8` or later
- Until updated, restrict author and higher accounts to trusted users

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111972
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111972

## From the sources

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_