未評価

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper...

CVE-2026-115259 SecPulse初出 15:00

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
CVE	Photo Engine (Media Organizer & Lightroom)	6.6.0 未満	6.6.0

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web contact@wpscan.com
web nvd.nist.gov
web wpscan.com
web github.com