---
id: CVE-2026-111972
title: Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
summary: >-
  The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8
  does not verify that a user is authorised to act on the targeted media
  attachment, allowing authenticated users with the author role and above to
  delete arbitra…
severity: none
cwe:
  - CWE-639
product: Photo Engine (Media Organizer & Lightroom)
affected:
  - photo_engine_media_organizer_lightroom < 6.5.8
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T06:00:18.311Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111972'
references:
  - url: 'https://wpscan.com/vulnerability/3566b7d5-d90d-4212-af6f-3f2437407a65/'
tags:
  - cve.org
ingestedAt: '2026-10-22T06:30:48.516Z'
---

## Overview

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.

## Affected

- `photo_engine_media_organizer_lightroom < 6.5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.