Live › vulnerability › CVE-2026-119087
The Content Egg WordPress plugin up to and including 12.0.0 lets an author-level user create posts attributed to another account, typically an administrator, by supplying an admin-owned preset_id. The attacker gets administrator-attributed published content, which can be used to make content look like it came from an admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the Content Egg plugin version 12.0.0 or earlier where authors or other logged-in users with publish rights exist. The flaw needs an authenticated account with author-level access, so sites with only trusted editors or no author accounts are at lower risk. unknown whether a fixed version exists.
No product ranges from the sources yet.
wp plugin get content-egg --field=versionNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user.
This page as .md · .json · in your agent: get_signal("CVE-2026-119087")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.