Photo Engine EUVD-2026-108017

Requires a pre-existing authenticated account with the WordPress 'author' role or above on a site running Photo Engine (Media Organizer & Lightroom) before 6.5.8; the plugin must be installed and active. No special plugin configuration mode is stated as a prerequisite in the available sources. Exploitation is limited by the authenticated author-level requirement (not reachable by unauthenticated visitors or subscriber-tier users) and by impact scope - only media attachment deletion (integrity), with no confidentiality exposure, no code execution, and no stated availability impact to the wider site.

This is a moderate, not emergency, priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9) describes a network-reachable, low-complexity flaw whose impact is confined to integrity (arbitrary media deletion) with no confidentiality or availability loss. The single most important limiter is privilege: exploitation requires an existing authenticated account. There is a notable internal inconsistency - the NVD vector assigns PR:H, yet the description states the minimum requirement is the WordPress 'author' role, which is a low-privilege contributor-tier account, not an administrator; this argues for PR:L and a slightly higher real-world reachability than the 4.9 score implies (verify role mapping with the WPScan advisory). No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not in CISA KEV, and only a WPScan PoC reference exists (not verified as working exploit code), so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cycle item rather than an act-now emergency. Net: a genuine authorization flaw worth patching on a routine cadence, but gated behind author-level access and limited to data destruction, not a critical widespread-risk issue.

An attacker who already holds an author-role (or higher) account on a WordPress site running Photo Engine before 6.5.8 sends a media-deletion request referencing an attachment owned by another user or an administrator. Because the plugin never checks that the caller is authorized to act on that attachment (CWE-639), the deletion succeeds, letting the attacker destroy media uploaded by others. A public PoC reference from WPScan exists; it is not verified as working exploit code.