Read the docs
TI-2026-85484 Aliases CVE-2026-119751GHSA-wxpj-24h4-8v79

Content Egg WordPress plugin leaks data from unpublished posts

Priority LOW 36CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The Content Egg plugin for WordPress before 12.1.0 by keywordrush has a missing authorization flaw (CWE-862). An unauthenticated remote attacker can call a REST route to retrieve product data from draft, pending, scheduled, or private posts, including product titles, affiliate URLs, merchant information and descriptions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed Content Egg – Affiliate Product Importer & Price Comparison (keywordrush): 12.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
keywordrushContent Egg – Affiliate Product Importer & Price Comparisonup to 12.0.012.1.0Patch availableCNA
  • Content Egg – Affiliate Product Importer & Price Comparison Vendorkeywordrush Affected up to 12.0.0 Fixed in 12.1.0 Patch available CNA

Remediation

Update the Content Egg plugin to version 12.1.0, the fixed version for releases from 0 through 12.0.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Content Egg – Affiliate Product Importer & Price Comparison (keywordrush) Fixed in 12.1.0

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-119751
  2. 2026-11-05 Alias added: GHSA-wxpj-24h4-8v79
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW

References

Patch 1

  • TI-2026-13381 Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion CVSS 3.1HIGH 8.1
  • TI-2022-09486 WordPress Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-63894 WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability CVSS 3.1HIGH 7.2
  • TI-2025-30033 WordPress Content Egg plugin <= 7.0.0 - PHP Object Injection Vulnerability CVSS 3.1HIGH 7.2
  • TI-2022-00352 Content Egg < 5.3.0 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2026-82936 Content Egg lets authors create posts attributed to administrators CVSS 3.1MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences