Arbitrary Media Deletion Vulnerability in Photo Engine Plugin by WordPress
CVE-2026-111972

Currently unrated

Key Information:

Vendor

WordPress
Status
Photo Engine (media Organizer & Lightroom)
Vendor
CVE Published:
22 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-111972?

The Photo Engine WordPress plugin is affected by a vulnerability that allows authenticated users with author privileges and above to delete arbitrary media attachments. This occurs because the plugin fails to properly verify whether the user is authorized to manipulate the targeted media files. Consequently, users can delete media files uploaded by other users, including administrators, posing a significant risk to the integrity of media content within WordPress installations. Users are encouraged to upgrade to version 6.5.8 or later to mitigate this vulnerability.

Affected Version(s)

Photo Engine (Media Organizer & Lightroom) 0 < 6.5.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-111972 - Proof of Concept

References

https://wpscan.com/vulnerability/3566b7d5-d90d-4212-af6f-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mahammad Mammadov
WPScan
.