CVE-2026-123666: falha de média gravidade em Photo Engine (Media Organizer & Lightroom)
Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
Unknown · Photo Engine (Media Organizer & Lightroom)CVEs relacionadas — Photo Engine (Media Organizer & Lightroom)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111971MEDIUMPhoto Engine < 6.5.8 - Author+ Stored XSS via Collection NameEPSS 0.3%CVE-2026-111972MEDIUMPhoto Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOREPSS 0.3%CVE-2026-115259MEDIUMPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOREPSS 0.2%CVE-2026-123667MEDIUMPhoto Engine < 6.6.2 - Author+ Stored XSS via Keyword NamesEPSS —