{"id":"CVE-2026-119059","kind":"vulnerability","aliases":["CVE-2026-119059"],"related":[],"title":"WordPress Content Egg plugin lets contributors edit other users' posts","description":"The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.","summary":"The Content Egg plugin for WordPress checks only a generic editing permission before updating product data, not whether the user may edit the specific post. An authenticated contributor can therefore change product data and timestamps on any post, including posts owned by administrators.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["content-egg","runtime","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check whether the Content Egg plugin is installed and its version is `12.0.0` or lower on the WordPress site\n- Review Content Egg product data on posts not authored by the account in question, if contributor accounts exist","fix":null,"status":"open","published_at":"2026-10-30T06:16:48+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:29:56+00:00","updated_at":"2026-10-30T06:29:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T06:29:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WordPress Content Egg plugin lets contributors edit other users' posts","impact":"medium","summary":"The Content Egg plugin for WordPress checks only a generic editing permission before updating product data, not whether the user may edit the specific post. An authenticated contributor can therefore change product data and timestamps on any post, including posts owned by administrators.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","content-egg","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"contributor can alter product data on administrators' posts","analyst_note":"","how_to_check":"- Check whether the Content Egg plugin is installed and its version is `12.0.0` or lower on the WordPress site\n- Review Content Egg product data on posts not authored by the account in question, if contributor accounts exist\n- unknown whether a specific fixed version is available from the sources","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-accounts"],"who_is_affected":"Sites running the Content Egg WordPress plugin at version 12.0.0 or earlier where contributor-level or higher accounts can log in. Exposure depends on the plugin's product-data endpoint being reachable by those accounts, which is the default for logged-in users. Sites without the plugin, or without untrusted contributor accounts, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4283,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119059':13A,16A '-2026':12A,15A '12.0.0':100C 'access':160C 'administr':67B,184C 'ajaxupdateproduct':92C 'arbitrari':178C 'attack':119C,155C 'attacker-suppli':118C 'authent':51B,154C 'call':127C 'capabl':88C,114C 'cegg':169C 'chang':55B 'check':31B,89C,139C 'content':2A,18B,26B,69C,165C 'content-egg':17B 'contentegg':107C 'contributor':6A,52B,158C 'contributor-level':157C 'correct':147C 'current':128C 'cve':11A,14A 'data':40B,57B,80C,168C,170C 'due':81C 'edit':7A,35B,46B,112C,131C 'egg':3A,19B,27B,70C,166C 'function':93C 'generic':34B,111C 'handler':102C,145C 'host':23B 'id':123C,134C 'includ':63B,99C,180C 'let':5A 'level':159C 'make':150C 'may':45B 'meta':176C 'metabox':108C 'miss':84C 'modif':78C 'modifi':164C 'never':126C 'nonc':106C 'object':138C 'own':65B,182C 'per':86C,137C 'per-object':136C 'per-post':85C 'perform':148C 'permiss':36B 'plugin':4A,28B,71C 'possibl':152C 'post':10A,49B,62B,64B,87C,113C,121C,122C,132C,133C,144C,175C,179C 'product':39B,56B,167C 'runtim':20B 'save':143C 'savemeta':146C 'self':22B 'self-host':21B 'sibl':142C 'specif':48B 'static':105C 'suppli':120C 'therefor':54B 'timestamp':59B,174C 'trust':116C 'unauthor':77C 'updat':38B,173C 'update-timestamp':172C 'user':9A,44B,129C 'verbatim':124C 'verifi':103C 'version':95C 'vulner':75C 'whether':42B 'wordpress':1A,24B,30B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Content Egg WordPress plugin at version 12.0.0 or earlier where contributor-level or higher accounts can log in. Exposure depends on the plugin's product-data endpoint being reachable by those accounts, which is the default for logged-in users. Sites without the plugin, or without untrusted contributor accounts, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119059","severity":null,"published_at":"2026-10-30T06:16:48+00:00","modified_at":"2026-10-30T06:16:48+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}