CVE-2026-111972

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

EUVD-2026-108017

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

PT-2026-121273

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

CVE-2026-110253: Improper Limitation of a Pathname to a Restricted Directory

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-12995: Authorization Bypass Through User-Controlled Key

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2026-87829: Authorization Bypass Through User-Controlled Key

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

PT-2026-94193

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...