Ghostwire

CVE-2026-111972: The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised...

MEDIUM CVSS 4.9 Exploit Available

Published: October 22, 2026 | Last Modified: October 22, 2026

Description

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.

Ghostwire Analysis — What This Means Practically

Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

wpscan.com/vulnerability/3566b7d5-d90d-4212-af6f-3f2437407a65/
www.tenable.com/cve/CVE-2026-111972
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-111972