CVE-2026-115259: Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Photo Engine (Media Organizer & Lightroom) WordPress pluginto a version that resolves this vulnerability.Fixed in 6.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Author-level access or higher can exploit the affected REST API route. The issue can be used to modify posts, pages, and attachments owned by other users.
Which content can be changed?
An attacker can modify titles, content, excerpts, and other post-data fields for arbitrary posts, pages, and attachments.
What versions are affected?
All Photo Engine versions through 6.5.8 are affected. Version 6.6.0 is not included in the affected range described.