CVE-2026-115259
Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
| Vendor | unknown |
| Product | photo engine (media organizer & lightroom) |
| Published | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown photo engine (media organizer & lightroom)
Be the first to know when new unknown vulnerabilities affecting unknown photo engine (media organizer & lightroom) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Photo Engine (Media Organizer & Lightroom)
0 < 6.6.0
References
Credits
Mahammad Mammadov WPScan