What is GHSA-9rg9-xfxx-rmvr?

GHSA-9rg9-xfxx-rmvr is a security advisory published by GitHub Security Advisories with Medium severity. The Photo Engine (Media Organizer \u0026 Lightroom) WordPress plugin before 6.6.2 does not check that...

Which CVE IDs does GHSA-9rg9-xfxx-rmvr cover?

GHSA-9rg9-xfxx-rmvr covers the following CVE IDs: CVE-2026-123666. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9rg9-xfxx-rmvr?

GHSA-9rg9-xfxx-rmvr has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-9rg9-xfxx-rmvrMediumCVSS 4.9

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-123666 →

📋 Description

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-123666
https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214
https://github.com/advisories/GHSA-9rg9-xfxx-rmvr