All vulnerabilities
CVE-2026-115259

Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR

Unknown Photo Engine (Media Organizer & Lightroom)
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in6.6.0Fixed versionCVE List
Published29 Oct 2026Updated 29 Oct 2026CVE List

What fixes it

  • 6.6.0Photo Engine (Media Organizer & Lightroom)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

Text from CVE List

Affected versions 1

  • Photo Engine (Media Organizer & Lightroom)affected: all versions before 6.6.0CVE List

References 1