CVE-2026-115259mediumCWE-639

CVE-2026-115259: medium-severity vulnerability in Photo Engine (Media Organizer & Lightroom)

Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR

Published

Follow this CVE+ Monitor Photo Engine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.9epss 0.2%
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · Photo Engine (Media Organizer & Lightroom)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Photo Engine (Media Organizer & Lightroom)

In the same product, most dangerous first.

CVE-2026-111971MEDIUMPhoto Engine < 6.5.8 - Author+ Stored XSS via Collection NameEPSS 0.3%CVE-2026-111972MEDIUMPhoto Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOREPSS 0.3%