Vulnerability · Published Oct 29, 2026 · Assigned by WPScan

CVE-2026-115259Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR

Medium 4.9

In plain English

A medium-severity authorization bypass via user-controlled key in Photo Engine (Media Organizer & Lightroom) from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.2%top 91.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Photo Engine (Media Organizer & Lightroom)	0 – before 6.6.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References

https://wpscan.com/vulnerability/ef3a6287-bc56-464d-a13f-d3aee46a8df5/ exploit, vdb-entry, technical-description