{"affected":[{"defaultStatus":"unaffected","product":"Photo Engine (Media Organizer & Lightroom)","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.6.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123666","cwes":["CWE-639"],"description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/"}],"kev":null,"metrics":[],"modifiedAt":1794376813465,"publishedAt":1794376813465,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/"}],"remediation":[],"revision":"3fd1b49a388358704f034dae1ff0ecca5f6fe2a6b476861ae4d16fad5ac7dd96","sources":[{"modifiedAt":1794376813465,"name":"CNA: WPScan","retrievedAt":1794377425025,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123666"}],"ssvc":null,"status":"published","title":"Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion","updatedAt":1794377425025}