Unrated severityNVD Advisory· Published Nov 11, 2026
CVE-2026-123666
CVE-2026-123666
Description
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<6.6.2+ 1 more
- (no CPE)range: <6.6.2
- (no CPE)range: <6.6.2
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.