CVE-2026-119059mediumCWE-862

CVE-2026-119059: falha de média gravidade em keywordrush Content Egg – Affiliate Product…

Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action

Publicada em

Seguir esta CVE+ Monitorar Content Egg – Affiliate Product Importer & Price Comparison

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.2%
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
keywordrush · Content Egg – Affiliate Product Importer & Price Comparison
CVEs relacionadas — keywordrush Content Egg – Affiliate Product…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-15979HIGHContent Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File DeletionEPSS 1.2%CVE-2026-119751MEDIUMContent Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocksEPSS 0.3%CVE-2026-119087MEDIUMContent Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' ParameterEPSS 0.2%