Authorization Bypass in Content Egg Affiliate Product Importer for WordPress

CVE-2026-119087

What is CVE-2026-119087?

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is exposed to an authorization bypass vulnerability in all versions up to 12.0.0. This flaw arises from the plugin's inadequate verification of user authorization, allowing authenticated attackers with author-level access or higher to create posts that are falsely attributed to a more privileged user, typically an administrator. By manipulating the admin-owned preset_id, an attacker can leverage the wp_insert_post function to attribute the newly created post to the administrator, including the potential to publish content even when the attacker has lower privileges. This behavior compromises the integrity of post authorship and can lead to the unauthorized dissemination of content.

References