CVE-2026-123666

— UNSCORED

Published 2026-11-11 · Updated 2026-11-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.

All references

https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.