https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 20:28:13 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119059 <p>The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce (&#39;contentegg_metabox&#39;) and the generic &#39;edit_posts&#39; capability, but trusts the attacker-supplied $_POST[&#39;post_id&#39;] verbatim and never calls current_user_can(&#39;edit_post&#39;, $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.</p> <p>The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce (&#39;contentegg_metabox&#39;) and the generic &#39;edit_posts&#39; capability, but trusts the attacker-supplied $_POST[&#39;post_id&#39;] verbatim and never calls current_user_can(&#39;edit_post&#39;, $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119059 https://db.gcve.eu/vuln/ghsa-65m9-fpqg-cx7w <p>The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce (&#39;contentegg_metabox&#39;) and the generic &#39;edit_posts&#39; capability, but trusts the attacker-supplied $_POST[&#39;post_id&#39;] verbatim and never calls current_user_can(&#39;edit_post&#39;, $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.</p> <p>The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce (&#39;contentegg_metabox&#39;) and the generic &#39;edit_posts&#39; capability, but trusts the attacker-supplied $_POST[&#39;post_id&#39;] verbatim and never calls current_user_can(&#39;edit_post&#39;, $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.</p> https://db.gcve.eu/vuln/ghsa-65m9-fpqg-cx7w