CVE-2026-111972

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

EUVD-2026-108017

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

PT-2026-121273

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

PT-2026-94193

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

CVE-2026-12902 Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Attachment Creation vulnerability discovered by se1en in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.7...