Photo Engine CVE-2026-115259

Exploitation requires an authenticated WordPress account with Author-level capabilities or higher on a site running Photo Engine (Media Organizer & Lightroom) version 6.5.8 or earlier; the attacker then abuses one of the plugin's REST API routes that updates post data without verifying post ownership or authorization. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L), but the account requirement is the key limiting factor - the flaw is not reachable by anonymous/unauthenticated visitors, so it primarily threatens multi-user sites that provision Author (or higher) roles to semi-trusted contributors. Impact is limited to integrity (modifying posts, pages and attachments); no data disclosure or denial of service results. Updating to 6.6.0 is the vendor fix.

This is a broken-authorization / IDOR flaw (CWE-639) in a WordPress plugin, and the signals consistently point to a moderate, not urgent, priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9) scores only integrity impact (I:H) with no confidentiality or availability effect, matching the description: an attacker can alter the title, content, excerpt and other fields of arbitrary posts/pages/attachments but cannot read protected data or take the site down. SSVC agrees with a low-urgency posture - Exploitation: none, Automatable: no, Technical Impact: partial - and the vuln.today Decision label is 'this_month', not act_now or emergency. There is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation; a WPScan PoC reference exists but is not verified as working exploit code. One internal conflict should be verified: the input vector states PR:H (high privilege), yet the description requires only 'Author-level access and above', which in WordPress is a comparatively low-privilege role - this suggests the real privilege requirement is closer to PR:L, which would raise the honest base score slightly (to ~5.4) and make the vuln somewhat easier to reach than PR:H implies. Net: a genuine multi-user integrity/defacement risk on sites that hand out Author accounts, but not a drop-everything emergency.

On a multi-author WordPress site running Photo Engine 6.5.8 or earlier, an attacker who holds (or has obtained) an Author-level account sends a crafted request to the plugin's vulnerable REST API route, which fails to check post ownership. They overwrite the title, body and excerpt of posts, pages or attachments owned by other users - enabling content tampering, defacement or insertion of malicious/SEO-spam content. A WPScan PoC reference exists but is not verified as working exploit code, and exploitation requires low complexity (AC:L) but a valid authenticated account.