CVE-2026-111972: Photo Engine WordPress Privilege Escalation

CVE-2026-111972 Overview

CVE-2026-111972 affects The Photo Engine (Media Organizer & Lightroom) WordPress plugin in versions prior to 6.5.8. The plugin fails to verify that an authenticated user is authorized to act on a targeted media attachment. Authenticated users with the Author role or above can delete arbitrary media attachments, including those uploaded by other users and administrators. The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR).

Critical Impact
Authenticated contributors can destroy media assets across the entire WordPress site, including administrator uploads, resulting in content loss and broken pages.

Affected Products

The Photo Engine (Media Organizer & Lightroom) WordPress plugin versions prior to 6.5.8
WordPress sites with Author-level or higher accounts enabled
Any multi-author WordPress deployment using the vulnerable plugin

Discovery Timeline

2026-10-22 - CVE-2026-111972 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111972

Vulnerability Analysis

The Photo Engine plugin exposes media management actions to authenticated users without performing an ownership or capability check on the targeted attachment. When an authenticated user with the Author role or above submits a delete request referencing an attachment ID, the plugin processes the request without validating whether that user owns the attachment or holds the delete_others_posts capability.

This is a textbook Insecure Direct Object Reference. The attachment identifier is a user-controlled key, and the plugin trusts it without authorization enforcement. An attacker enumerates numeric attachment IDs and issues delete requests to remove images, documents, or other media uploaded by any user, including administrators.

The impact is limited to integrity. Attackers cannot read protected content or disable the site directly, but they can destroy media libraries, break published posts, and remove branding assets. Exploitation requires valid credentials at the Author level, which limits the attack surface to sites that provision contributor accounts.

Root Cause

The root cause is missing authorization logic in the plugin's attachment deletion handler. WordPress exposes capability functions such as current_user_can('delete_post', $attachment_id), but the vulnerable code path does not call them before invoking wp_delete_attachment(). The plugin treats authentication as equivalent to authorization.

Attack Vector

Exploitation requires an authenticated session with Author role privileges or higher. The attacker sends a crafted request to the vulnerable plugin endpoint containing an attachment ID belonging to another user. The server deletes the attachment without challenging the request. See the WPScan Vulnerability Report for technical details on the vulnerable endpoint.

// No verified proof-of-concept code is published.
// The vulnerability is described in prose above.

Detection Methods for CVE-2026-111972

Indicators of Compromise

Unexpected wp_delete_attachment events in WordPress logs originating from non-administrator accounts
Missing media files referenced by published posts, resulting in broken image links
Entries in the wp_posts table where attachment rows have been removed without corresponding author activity
Spikes in authenticated POST or AJAX requests to Photo Engine plugin endpoints from Author-role accounts

Detection Strategies

Enable WordPress audit logging to capture attachment deletion events with the acting user ID and originating IP
Correlate attachment deletions with the uploader's user ID to flag cross-user deletions
Alert on any Author or Contributor account deleting attachments owned by administrators
Monitor plugin AJAX endpoints for unusual request volumes from low-privilege accounts

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM for cross-user authorization anomaly detection
Baseline normal media deletion patterns per role and alert on deviations
Review new or recently promoted Author accounts for suspicious activity following role assignment

How to Mitigate CVE-2026-111972

Immediate Actions Required

Upgrade The Photo Engine (Media Organizer & Lightroom) plugin to version 6.5.8 or later on all WordPress instances
Audit existing Author, Editor, and higher-privilege accounts and remove any that are unnecessary
Review recent media deletions and restore critical assets from backup if integrity loss is suspected
Rotate credentials for any accounts suspected of compromise

Patch Information

The vendor addressed the vulnerability in version 6.5.8 of The Photo Engine (Media Organizer & Lightroom) plugin. The fix adds a capability check that validates whether the requesting user is authorized to delete the targeted attachment before invoking the WordPress deletion API. Refer to the WPScan Vulnerability Report for upgrade guidance.

Workarounds

Restrict Author-level and above accounts to trusted users until the plugin is patched
Deploy a web application firewall rule to block delete requests to the vulnerable plugin endpoint from non-administrator sessions
Temporarily disable the Photo Engine plugin if patching cannot be performed immediately
Maintain frequent off-site backups of the WordPress media library to enable rapid recovery

bash

# Example: disable the plugin via WP-CLI until patched
wp plugin deactivate wplr-sync
wp plugin update wplr-sync --version=6.5.8