CVE-2026-119751

What it is

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-10-30 15:31 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-11-05 16:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-11-05 21:18 UTC Last updatedMost recent change to the record

Details

Published

2026-11-05 16:17 UTC

Last modified

2026-11-05 21:18 UTC

Weakness

CWE-639 · Insecure direct object reference

Record status

Received

Attack profile CVSS 4.0 · 6.9

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None