CVE-2026-119059
Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
- Published
- Updated
- Reserved
- Assigned by
- Wordfence
Description
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
keywordrush · Content Egg – Affiliate Product Importer & Price Comparison
- affected ≤ 12.0.0
References (6)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bc503fac-1ae6-400a-b19d-d88f0016b8aa?source=cve (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/admin/EggMetabox.php#L436 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/admin/EggMetabox.php#L38 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/components/ContentManager.php#L1027 (opens in a new tab)
- https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/components/ContentManager.php#L1075 (opens in a new tab)
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3773366%40content-egg&new=3773366%40content-egg (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-119059)Record last updated .