The vulnerability is an Insecure Direct Object Reference in which an authenticated user with an author role or above can delete arbitrary media attachments. Deleting attachments that belong to other users or administrators removes content and can disrupt website functionality, causing data loss and reputational damage. The flaw stems from inadequate authorization checks for the delete action, corresponding to CWE-639.

The affected plugin is Photo Engine (Media Organizer & Lightroom). Any installation of the plugin before version 6.5.8 is susceptible; versions 6.5.8 and higher have applied the fix. No other vendors or products are listed.

Because the attacker must be authenticated, the attack surface is limited to legitimate users. The EPSS score of 0.00132 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the deficiency allows any author or higher user to silently delete media, which constitutes a significant integrity breach for content owners. The CVSS score is 4.9, indicating a medium severity risk with potential for widespread content loss.