EUVD-2026-112630

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

CVE-2026-111972

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

EUVD-2026-108017

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

EUVD-2026-108016

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

PT-2026-121273

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

PT-2026-121272

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

PT-2026-115488

Name of the Vulnerable Software and Affected Versions The Photo Engine Media Organizer & Lightroom versions prior to 6.5.7 Description An authorization bypass exists because the plugin fails to properly verify user permissions before performing actions. Unauthenticated attackers can permanently...