Broken Access Control in Content Egg Plugin for WordPress
CVE-2026-119751

6.9MEDIUM

Key Information:

Vendor

WordPress
Status
Content Egg – Affiliate Product Importer & Price Comparison
Vendor
CVE Published:
5 November 2026

What is CVE-2026-119751?

The Content Egg plugin for WordPress prior to version 12.1.0 has a broken access control issue that allows unauthorized users to access sensitive product data from unpublished posts. By exploiting a flaw in the permission checks of the REST API route, unauthenticated attackers can manipulate requests to retrieve information such as product titles, affiliate URLs, and descriptions linked to posts that are in draft, pending, or scheduled states. This vulnerability arises from the lack of proper validation for the X-WP-Nonce header, which could expose crucial data and compromise the integrity of unpublished content.

Affected Version(s)

Content Egg – Affiliate Product Importer & Price Comparison 0 <= 12.0.0

Content Egg – Affiliate Product Importer & Price Comparison 12.1.0

References

https://wordpress.org/plugins/content-egg/#developers
release-notespatch
https://www.vulncheck.com/advisories/content-egg-wordpres...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

buiih
.