CVE-2026-111972mediumCWE-639

CVE-2026-111972: medium-severity vulnerability in Photo Engine (Media Organizer & Lightroom)

Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR

Published

Follow this CVE+ Monitor Photo Engine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.9epss 0.3%
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · Photo Engine (Media Organizer & Lightroom)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Photo Engine (Media Organizer & Lightroom)

In the same product, most dangerous first.

CVE-2026-111971MEDIUMPhoto Engine < 6.5.8 - Author+ Stored XSS via Collection NameEPSS 0.3%CVE-2026-115259MEDIUMPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOREPSS 0.2%