CVE-2026-119059

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.

• CWE-862

• https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/admin/EggMetabox.php#L38
• https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/admin/EggMetabox.php#L436
• https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/components/ContentManager.php#L1027
• https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/components/ContentManager.php#L1075
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3773366%40content-egg&new=3773366%40content-egg
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc503fac-1ae6-400a-b19d-d88f0016b8aa?source=cve

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11905The Elementor Website Builder – more than just a page builde…4.3
• CVE-2026-119050Agno through 3.1.11 contains an unsafe reflection vulnerabil…8.1
• CVE-2026-119051flat through 6.0.1 contains an uncontrolled resource allocat…5.9
• CVE-2026-119052llama.cpp b2877 before b11935 contains an uncaught exception…7.5
• CVE-2026-119053lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains …5.3
• CVE-2026-119054Multiple Pages Generator by Themeisle before 4.2.5 contains …5.4
• CVE-2026-11906IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for…6.5
• CVE-2026-119065The Shipping Zones by Drawing for WooCommerce plugin for Wor…7.2
• CVE-2026-11907The Stream plugin for WordPress is vulnerable to authorizati…6.5
• CVE-2026-11908Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-119086Missing queue-set type validation in the queue-set selection…6.5
• CVE-2026-119087The Content Egg – Affiliate Product Importer & Price Compari…4.3