EUVD-2026-108017

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...