CVE-2026-123666 Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion
Author-level users can permanently delete other users' synced media, including administrators', in the Photo Engine WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-123666?
CVE-2026-123666 is a medium-severity missing authorization vulnerability in Unknown Photo Engine (Media Organizer & Lightroom), published on 11 Nov 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
Weakness: CWE-639
Which versions are affected by CVE-2026-123666?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-123666?
No fix has been published for CVE-2026-123666 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-123666 being exploited?
There is no known exploitation of CVE-2026-123666 in the wild and no public exploit code.
Sources
Also known as GHSA-9rg9-xfxx-rmvr.