CVE-2026-119087: Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter

Q: Who can exploit this issue?

An attacker must be authenticated to WordPress and have at least Author-level access. They also need access to an administrator-owned preset_id to cause a post to be attributed to that administrator.

Q: Can this be used to publish content immediately?

Yes, but only if the attacker already has the publish_posts capability for the post type associated with the preset. Otherwise, the issue still permits creation of posts attributed to another user, typically an administrator.

Q: Are versions beyond 12.0.0 known to be affected?

The available information identifies all Content Egg versions up to and including 12.0.0 as affected. It does not provide information about later versions.

Published Oct 30, 2026

Updated

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned presetid, causing wpinsertpost to record the administrator as postauthor. This includes the ability to create published posts when the attacker already holds publishposts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user.

Event History

Oct 30, 2026

CVE Published

via MITRE·05:35 AM

Data Sourced

via MITRE·05:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to WordPress and have at least Author-level access. They also need access to an administrator-owned preset_id to cause a post to be attributed to that administrator.

Can this be used to publish content immediately?

Yes, but only if the attacker already has the publish_posts capability for the post type associated with the preset. Otherwise, the issue still permits creation of posts attributed to another user, typically an administrator.

Are versions beyond 12.0.0 known to be affected?

The available information identifies all Content Egg versions up to and including 12.0.0 as affected. It does not provide information about later versions.

CVE-2026-119087: Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

Can this be used to publish content immediately?

Are versions beyond 12.0.0 known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Can this be used to publish content immediately?

Are versions beyond 12.0.0 known to be affected?