{"id":"CVE-2026-115259","kind":"vulnerability","aliases":["CVE-2026-115259"],"related":[],"title":"Photo Engine WordPress plugin lets authors edit other users' posts","description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin exposes a REST API route without proper authorization checks when updating post data. An authenticated Author-level user can change the title, content, excerpt and other fields of any post, page or attachment, including ones owned by other users.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photo-engine","self-hosted","wordpress"],"not_affected_if":["no-author-accounts","plugin-not-installed"],"how_to_check":"- Check whether the Photo Engine (Media Organizer & Lightroom) plugin is installed and its version in the WordPress admin under Plugins.\n- Confirm the installed version is below `6.6.0`; all versions up to and including `6.5.8` are listed as affected.","fix":"- Photo Engine (Media Organizer & Lightroom) plugin: move to `6.6.0` or later.","status":"open","published_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:46+00:00","updated_at":"2026-10-29T06:54:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:46Z","model":"claude-haiku-5-5","output":{"fix":"- Photo Engine (Media Organizer & Lightroom) plugin: move to `6.6.0` or later.","reach":"internet","title":"Photo Engine WordPress plugin lets authors edit other users' posts","impact":"medium","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin exposes a REST API route without proper authorization checks when updating post data. An authenticated Author-level user can change the title, content, excerpt and other fields of any post, page or attachment, including ones owned by other users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","photo-engine","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker alters content of any post, page or attachment","analyst_note":"","how_to_check":"- Check whether the Photo Engine (Media Organizer & Lightroom) plugin is installed and its version in the WordPress admin under Plugins.\n- Confirm the installed version is below `6.6.0`; all versions up to and including `6.5.8` are listed as affected.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-author-accounts"],"who_is_affected":"Sites running the Photo Engine WordPress plugin before 6.6.0 where authors or higher roles can log in. The attacker needs an Author-level account, so sites with only administrators, editors or no user accounts beyond trusted readers are lower risk. Sites that do not have the plugin installed are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4167,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115259':13A,16A '-2026':12A,15A '6.5.8':107C '6.6.0':82C 'access':119C 'api':36B,98C 'arbitrari':132C 'attach':66B,136C 'attack':114C 'authent':47B,113C 'author':6A,40B,49B,87C,117C 'author-level':48B,116C 'belong':139C 'chang':53B 'check':41B,88C 'content':56B,126C 'cve':11A,14A 'data':45B,92C 'edit':7A 'engin':2A,20B,27B,75C 'excerpt':57B,127C 'expos':33B 'field':60B,130C 'host':23B 'includ':67B,106C,137C 'let':5A 'level':50B,118C 'lightroom':30B,78C 'make':109C 'media':28B,76C 'modifi':123C 'one':68B,94C 'organ':29B,77C 'own':69B 'packag':17B 'page':64B,134C 'photo':1A,19B,26B,74C 'photo-engin':18B 'plugin':4A,32B,80C 'possibl':111C 'post':10A,44B,63B,91C,133C 'proper':39B,86C 'rest':35B,97C 'rout':37B,99C 'self':22B 'self-host':21B 'titl':55B,125C 'updat':43B,90C 'user':9A,51B,72B,142C 'version':102C 'without':38B 'wordpress':3A,24B,31B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Engine WordPress plugin before 6.6.0 where authors or higher roles can log in. The attacker needs an Author-level account, so sites with only administrators, editors or no user accounts beyond trusted readers are lower risk. Sites that do not have the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115259","severity":null,"published_at":"2026-10-29T06:17:19+00:00","modified_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}