Live › vulnerability › CVE-2026-119059
The Content Egg plugin for WordPress checks only a generic editing permission before updating product data, not whether the user may edit the specific post. An authenticated contributor can therefore change product data and timestamps on any post, including posts owned by administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the Content Egg WordPress plugin at version 12.0.0 or earlier where contributor-level or higher accounts can log in. Exposure depends on the plugin's product-data endpoint being reachable by those accounts, which is the default for logged-in users. Sites without the plugin, or without untrusted contributor accounts, can skip it.
No product ranges from the sources yet.
12.0.0 or lower on the WordPress siteUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (cegg_data*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-119059")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.