CVE-2026-123666
MEDIUM
NVD
CVSS Score
4.9
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.