---
id: "CVE-2026-119059"
kind: "vulnerability"
aliases: ["CVE-2026-119059"]
title: "WordPress Content Egg plugin lets contributors edit other users' posts"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["content-egg", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-10-30T06:16:48+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T06:29:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119059", "first_seen_at": "2026-10-30T06:28:39+00:00"}]
---

# WordPress Content Egg plugin lets contributors edit other users' posts

The Content Egg plugin for WordPress checks only a generic editing permission before updating product data, not whether the user may edit the specific post. An authenticated contributor can therefore change product data and timestamps on any post, including posts owned by administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Content Egg plugin is installed and its version is `12.0.0` or lower on the WordPress site
- Review Content Egg product data on posts not authored by the account in question, if contributor accounts exist

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119059

## From the sources

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_