{"id":"CVE-2026-123666","kind":"vulnerability","aliases":["CVE-2026-123666"],"related":[],"title":"Photo Engine WordPress plugin lets Authors delete other users' media","description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check permissions when deleting a media collection. Users with the Author role or higher can permanently delete other users' synced media, including administrators' files.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photo-engine","self-hosted","wordpress"],"not_affected_if":["plugin-6.6.2-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Photo Engine plugin version in the WordPress admin Plugins screen\n- Look for the plugin folder `photo-engine` under `wp-content/plugins/` and read its version header\n- Confirm which accounts hold the Author role or higher on the site","fix":"- Photo Engine (WordPress plugin): move to `6.6.2` or later","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:19+00:00","updated_at":"2026-11-11T06:27:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:19Z","model":"claude-haiku-5-5","output":{"fix":"- Photo Engine (WordPress plugin): move to `6.6.2` or later","reach":"network","title":"Photo Engine WordPress plugin lets Authors delete other users' media","impact":"medium","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check permissions when deleting a media collection. Users with the Author role or higher can permanently delete other users' synced media, including administrators' files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","photo-engine","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users permanently delete other users' media files","analyst_note":"","how_to_check":"- Check the installed Photo Engine plugin version in the WordPress admin Plugins screen\n- Look for the plugin folder `photo-engine` under `wp-content/plugins/` and read its version header\n- Confirm which accounts hold the Author role or higher on the site","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-6.6.2-or-later"],"who_is_affected":"Sites running the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 that have users with the Author role or higher. Sites without this plugin, or where only trusted editors hold accounts, have less exposure. The sources do not describe a configuration that changes exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4546,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123666':13A,16A '-2026':12A,15A '6.6.2':34B,70C 'administr':59B,107C 'allow':91C 'along':87C 'author':6A,47B,95C 'check':37B,73C 'collect':43B,83C,90C 'cve':11A,14A 'delet':7A,40B,53B,78C,85C,101C 'engin':2A,20B,27B,63C 'file':60B 'higher':50B 'host':23B 'includ':58B,106C 'let':5A 'lightroom':30B,66C 'may':77C 'media':10A,28B,42B,57B,64C,80C,105C 'organ':29B,65C 'packag':17B 'perman':52B,100C 'permiss':38B 'photo':1A,19B,26B,62C 'photo-engin':18B 'plugin':4A,32B,68C 'role':48B,96C 'self':22B 'self-host':21B 'sync':56B,104C 'user':9A,44B,55B,76C,92C,103C 'wordpress':3A,24B,31B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 that have users with the Author role or higher. Sites without this plugin, or where only trusted editors hold accounts, have less exposure. The sources do not describe a configuration that changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","photoengine","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123666':13A,16A '-2026':12A,15A 'author':6A 'cve':11A,14A 'delet':7A 'engin':2A 'let':5A 'media':10A 'photo':1A 'plugin':4A 'user':9A 'wordpress':3A","search_b":"'6.6.2':34B 'administr':59B 'author':47B 'check':37B 'collect':43B 'delet':40B,53B 'engin':20B,27B 'file':60B 'higher':50B 'host':23B 'includ':58B 'lightroom':30B 'media':28B,42B,57B 'organ':29B 'packag':17B 'perman':52B 'permiss':38B 'photo':19B,26B 'photo-engin':18B 'plugin':32B 'role':48B 'self':22B 'self-host':21B 'sync':56B 'user':44B,55B 'wordpress':24B,31B","search_c":"'6.6.2':70C 'administr':107C 'allow':91C 'along':87C 'author':95C 'check':73C 'collect':83C,90C 'delet':78C,85C,101C 'engin':63C 'includ':106C 'lightroom':66C 'may':77C 'media':64C,80C,105C 'organ':65C 'perman':100C 'photo':62C 'plugin':68C 'role':96C 'sync':104C 'user':76C,92C,103C 'wordpress':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123666","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}