---
id: CVE-2026-119059
title: >-
  Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+)
  Arbitrary Post Meta Modification via 'post_id' Parameter via
  cegg_update_products AJAX Action
summary: >-
  The Content Egg plugin for WordPress is vulnerable to unauthorized
  modification of data due to a missing per-post capability check on the
  ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The
  handler verifies a stat…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: keywordrush
product: Content Egg – Affiliate Product Importer & Price Comparison
affected:
  - content_egg_affiliate_product_importer_price_comparison <= 12.0.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:32:59.830353Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:09:00.924Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119059'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/bc503fac-1ae6-400a-b19d-d88f0016b8aa?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/admin/EggMetabox.php#L436
  - url: >-
      https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/admin/EggMetabox.php#L38
  - url: >-
      https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/components/ContentManager.php#L1027
  - url: >-
      https://plugins.trac.wordpress.org/browser/content-egg/tags/12.0.0/application/components/ContentManager.php#L1075
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3773366%40content-egg&new=3773366%40content-egg
tags:
  - cve.org
epss: 0.00204
epssPercentile: 0.10413
ingestedAt: '2026-11-05T16:24:31.317Z'
---

## Overview

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.

## Affected

- `content_egg_affiliate_product_importer_price_comparison <= 12.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.