Live › vulnerability › CVE-2026-115259
The Photo Engine (Media Organizer & Lightroom) WordPress plugin exposes a REST API route without proper authorization checks when updating post data. An authenticated Author-level user can change the title, content, excerpt and other fields of any post, page or attachment, including ones owned by other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Photo Engine WordPress plugin before 6.6.0 where authors or higher roles can log in. The attacker needs an Author-level account, so sites with only administrators, editors or no user accounts beyond trusted readers are lower risk. Sites that do not have the plugin installed are not affected.
No product ranges from the sources yet.
6.6.0; all versions up to and including 6.5.8 are listed as affected.6.6.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-115259")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.