CVE-2026-123666: fallo de gravedad media en Photo Engine (Media Organizer & Lightroom)
Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Unknown · Photo Engine (Media Organizer & Lightroom)CVEs relacionadas — Photo Engine (Media Organizer & Lightroom)
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-111971MEDIUMPhoto Engine < 6.5.8 - Author+ Stored XSS via Collection NameEPSS 0.3%CVE-2026-111972MEDIUMPhoto Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOREPSS 0.3%CVE-2026-115259MEDIUMPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOREPSS 0.2%CVE-2026-123667MEDIUMPhoto Engine < 6.6.2 - Author+ Stored XSS via Keyword NamesEPSS —