---
id: "CVE-2026-115259"
kind: "vulnerability"
aliases: ["CVE-2026-115259"]
title: "Photo Engine WordPress plugin lets authors edit other users' posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "photo-engine", "self-hosted", "wordpress"]
not_affected_if: ["no-author-accounts", "plugin-not-installed"]
published_at: "2026-10-29T06:17:19+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115259", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# Photo Engine WordPress plugin lets authors edit other users' posts

The Photo Engine (Media Organizer & Lightroom) WordPress plugin exposes a REST API route without proper authorization checks when updating post data. An authenticated Author-level user can change the title, content, excerpt and other fields of any post, page or attachment, including ones owned by other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Photo Engine (Media Organizer & Lightroom) plugin is installed and its version in the WordPress admin under Plugins.
- Confirm the installed version is below `6.6.0`; all versions up to and including `6.5.8` are listed as affected.

## Fix

- Photo Engine (Media Organizer & Lightroom) plugin: move to `6.6.0` or later.

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115259

## From the sources

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_