Description
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Photo Engine (Media Organizer & Lightroom) | < 6.6.2 | 6.6.2 |
References
- https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/ exploit vdb-entry technical-description