{"id":"CVE-2026-119751","published":"2026-11-05T16:17:40.717","lastModified":"2026-11-05T21:18:41.527","description":"Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wordpress.org/plugins/content-egg/#developers","tags":[]},{"url":"https://www.vulncheck.com/advisories/content-egg-wordpress-plugin-unauthenticated-information-disclosure-via-render-blocks","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}