CVE-2026-123666: medium-severity vulnerability in Photo Engine (Media Organizer & Lightroom)
Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · Photo Engine (Media Organizer & Lightroom)Related CVEs — Photo Engine (Media Organizer & Lightroom)
In the same product, most dangerous first.
CVE-2026-111971MEDIUMPhoto Engine < 6.5.8 - Author+ Stored XSS via Collection NameEPSS 0.3%CVE-2026-111972MEDIUMPhoto Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOREPSS 0.3%CVE-2026-115259MEDIUMPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOREPSS 0.2%CVE-2026-123667MEDIUMPhoto Engine < 6.6.2 - Author+ Stored XSS via Keyword NamesEPSS —