Keywordrush Content Egg Plugin up to 12.0.0 REST API render-blocks permission_check post_id/module_id access control

Summaryinfo

A vulnerability labeled as problematic has been found in Keywordrush Content Egg Plugin up to 12.0.0. The impacted element is the function permission_check of the file /wp-json/content-egg/v1/render-blocks of the component REST API. Such manipulation of the argument post_id/module_id leads to access control. This vulnerability is traded as CVE-2026-119751. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Keywordrush Content Egg Plugin up to 12.0.0. It has been rated as problematic. Affected by this issue is the function permission_check of the file /wp-json/content-egg/v1/render-blocks of the component REST API. The manipulation of the argument post_id/module_id with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. CVE summarizes:

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.

The advisory is shared for download at wordpress.org. This vulnerability is handled as CVE-2026-119751 since 10/30/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 12.1.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Keywordrush

Name

• Content Egg Plugin

Version

• 12.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion