Content Egg CVE-2026-119087

Requires an authenticated WordPress account with author-level capability or above on a site where the Content Egg plugin (≤12.0.0) is installed and active, plus knowledge of a valid administrator-owned preset_id to supply to the import routine. To create published (rather than draft) admin-attributed content, the attacker must additionally hold the publish_posts capability for the preset's post type. Exploitation is limited by this authentication requirement (PR:L) - it is not reachable by fully unauthenticated users - and the impact is confined to post authorship/attribution integrity, with no confidentiality or availability effect.

This is a genuine but modest-severity issue best treated as a routine-priority fix rather than an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) tells a coherent story: network-reachable, low attack complexity, but it requires an authenticated account (PR:L) and yields only a limited integrity impact (I:L) with no confidentiality or availability loss. The vuln.today decision label is 'this_month', which aligns with that medium rating - not 'act_now' or 'emergency'. No CISA KEV listing is present in the input and no EPSS score was provided, so there is no signal of active or probable exploitation; absence of those signals is not proof of safety but does argue against widespread automated attacks. The impact is narrow: a lower-privileged author-level user can cause posts to be attributed (and potentially published) under an administrator's account via an admin-owned preset_id, which is primarily a content-integrity, attribution-spoofing, and repudiation concern rather than code execution or data theft. The required author-level-and-above account is the main factor keeping real-world risk low, so this matters most on multi-author sites where untrusted contributors hold author roles. No conflicting signals were found between the CVSS vector and the description - both agree on authenticated, limited-integrity impact.

On a multi-author WordPress site running Content Egg, a user holding only an author-level account calls the plugin's import queue functionality and supplies a preset_id that belongs to an administrator. Because the plugin does not verify ownership of the preset, wp_insert_post records the administrator as post_author, letting the attacker create (and, if they hold publish_posts for that post type, publish) content falsely attributed to the admin. Exploitation is remote and low-complexity but requires the attacker to already be authenticated at author level or above; no public working exploit is identified in the provided data.