Content Egg CVE-2026-15979

Exploitation requires an authenticated WordPress user account assigned the author role or a higher-privileged role (editor, administrator). The Content Egg plugin must be installed and active on the target WordPress site. The attacker must have the ability to create or edit posts and write arbitrary values to the cegg_data post metadata img_file field - this is available through the standard WordPress post editor with no special plugin configuration required. Exploitation is then triggered automatically when the plugin's image deletion code path processes the crafted metadata value. Key limiting factors: (1) unauthenticated or subscriber/contributor-level users cannot exploit this - the author role is the minimum threshold; (2) the PHP process must have filesystem write/delete permissions to the target file, which is standard for WordPress installations but may be restricted by hardened PHP-FPM configurations or SELinux/AppArmor policies; (3) the plugin must be active, not merely installed.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately reflects the threat profile: network-reachable exploitation with low complexity, no user interaction, and high integrity plus availability impact. The PR:L requirement - author-level WordPress access - is the primary real-world risk gate. In multi-author WordPress environments (news sites, content farms, affiliate blogs), author accounts are frequently granted to external contributors, freelancers, or compromised accounts, making this attack surface non-trivial. The I:H and A:H ratings are well-justified: deleting wp-config.php exposes database credentials on some configurations and forces the site into reinstallation mode, while deleting core PHP files causes complete availability loss. The Wordfence tag explicitly includes RCE as a downstream consequence. No EPSS score was provided in the input data; no KEV listing and no public POC have been identified at time of analysis, which moderates urgency relative to the raw CVSS score. The absence of a confidentiality impact (C:N) is consistent with a pure deletion primitive - the attacker cannot read file contents through this vector alone.

An attacker with a compromised or legitimately obtained WordPress author account navigates to the post editor, sets the cegg_data post metadata img_file field to a path traversal payload such as ../../../../wp-config.php, and saves or updates the post. When Content Egg's image deletion logic processes this metadata through getFullImgPath() and calls unlink(), the server deletes wp-config.php outside the plugin's intended directory scope. With wp-config.php removed, WordPress enters its installation wizard on the next page load, allowing the attacker - or any visitor - to point the site at an attacker-controlled database and gain full administrative access, achieving remote code execution.