EUVD-2026-113716: Missing capability check reported in Content Egg plugin
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Keywordrush
- Product
- Content Egg
- First seen
Summary
EUVD record EUVD-2026-113716 rates a missing per-post capability check in the Content Egg WordPress plugin at 4.3/10 (CVSS v3.1). The item says it allows unauthorized modification of data through the ajaxUpdateProducts() function.
If you use Keywordrush
Check whether Content Egg is installed on your WordPress sites
Update Content Egg to the latest patched version
Review recently modified affiliate product data
Confirm whether your site runs Content Egg 12.0.0 or earlier
Update to a version newer than 12.0.0 once a fix is available
Review user roles and permissions on sites using the plugin
What the sources say 2
· Mastodon: “The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0” Source
· Mastodon: “The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including” Source