CVE-2026-115259

Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

Affected

Photo Engine (Media Organizer & Lightroom)

CVSS v3.1 CNA

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 9th percentile

Published

2026-10-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ef3a6287-bc56-464d-a13f-d3aee46a8df5/find archive

CVE references

• https://wpscan.com/vulnerability/ef3a6287-bc56-464d-a13f-d3aee46a8df5REFERENCE

References

• CVE Record
• NVD entry