WordPress Plugin Vulnerabilities

Photo Engine < 6.6.2 - Author+ Media Deletion via Collection Deletion

Description

The plugin does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.

Proof of Concept

Affects Plugins

Plugin icon
wplr-sync
Fixed in 6.6.2

References

CVE
CVE-2026-123666

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Aabideen Bangash
Submitter
Aabideen Bangash
Submitter website
https://www.linkedin.com/in/aabideen-bangash/
Verified
Yes
WPVDB ID
2d65ab42-36cd-4ba1-8c2d-08eae7cd7214

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2026-04-14
Title
MetForm Pro < 3.9.8 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'
Published
2022-07-25
Title
SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
Published
2026-07-24
Title
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
Published
2024-03-29
Title
Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-10-21
Title
Interactive Content – H5P < 1.17.10 - Authenticated (Contributor+) Insecure Direct Object Reference