CVE-2026-111972: Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR

Q: Which users can exploit this issue?

Any authenticated WordPress user with the Author role or a higher-privileged role can exploit it. The affected user does not need to own the media attachment they target.

Q: What access does an attacker need?

An attacker must be able to authenticate to the WordPress site with an Author-level account or higher. The issue permits deletion of arbitrary media attachments, including attachments uploaded by administrators or other users.

Q: Which plugin versions are affected?

Photo Engine versions earlier than 6.5.8 are affected. Version 6.5.8 is the first version identified as not affected.

Published Oct 22, 2026

Updated

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.

Affected Software

1 affected component

Photo Engine Photo Engine (Media Organizer & Lightroom)<6.5.8

Event History

Oct 22, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with the Author role or a higher-privileged role can exploit it. The affected user does not need to own the media attachment they target.

What access does an attacker need?

An attacker must be able to authenticate to the WordPress site with an Author-level account or higher. The issue permits deletion of arbitrary media attachments, including attachments uploaded by administrators or other users.

Which plugin versions are affected?

Photo Engine versions earlier than 6.5.8 are affected. Version 6.5.8 is the first version identified as not affected.