CVE-2026-123666: Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Users with the WordPress Author role or any higher-privileged role can exploit it. They can permanently delete synced media belonging to other users, including administrators.
What condition is required for media to be deleted?
The affected media must be synced and included in a collection that the attacker can delete. Deleting that collection can also delete its media without verifying ownership or permission to delete the individual media.
How can I determine whether my site is affected?
Sites using Photo Engine versions before 6.6.2 are affected. Review whether Author-level users can create or delete collections containing media synchronized by other accounts.
What can be done before updating?
Restrict untrusted users from holding the Author role or higher, and limit their ability to manage Photo Engine collections. Back up media and collection data because the deletion is permanent.