The plugin does not enforce proper authorization when a REST API route updates post data, allowing an authenticated user with author role to change titles, content, excerpts and other fields of any post, page or attachment. This results in a breach of content integrity and can be used to deface sites or insert malicious material. The weakness is an insecure direct object reference or improper authorization issue.

Affected systems are installations of the Photo Engine WordPress plugin, all versions prior to 6.6.0, including 6.5.8. Users who have author or higher roles on the site can exploit the flaw.

The flaw requires only authenticated access, so any user assigned a contributor, author or higher role becomes a potential attacker. No publicly available exploits are reported and the EPSS score is unavailable, but the vulnerability could be leveraged as a low‑effort privilege‑increasing and data‑tampering vector. It is not currently in the CISA KEV list.