{"id":"CVE-2026-123666","published":"2026-11-11T06:17:18.200","lastModified":"2026-11-11T06:17:18.200","description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}