Content Egg Affiliate Product Importer Price Comparison
Monthly
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Authorization bypass in the Content Egg affiliate importer plugin for WordPress (all versions up to and including 12.0.0) lets an authenticated user with author-level access or above create posts that WordPress records as authored by a different account - typically an administrator - by supplying a preset_id owned by that administrator to the plugin's import routine. When the attacker also holds publish_posts capability for the preset's post type, the resulting administrator-attributed content can be published rather than left as a draft, damaging authorship integrity on the site. The flaw is remote and low-complexity but requires a valid low-privileged account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3); there is no confidentiality or availability impact, no public exploit code or PoC reference was identified at time of analysis, and it is not in CISA KEV. Our assessment rates it a genuine but modest-severity issue best handled as a routine-priority fix.
Missing per-post authorization in the Content Egg affiliate product importer plugin for WordPress (versions up to and including 12.0.0) allows an authenticated user with contributor-level access or above to overwrite Content Egg product data and update-timestamp post meta on arbitrary posts, including posts owned by administrators. The ajaxUpdateProducts() handler validates a static 'contentegg_metabox' nonce and the generic edit_posts capability, then trusts the attacker-supplied post_id without ever calling current_user_can('edit_post', $post_id). Impact is limited to integrity (I:L) with no confirmed confidentiality or availability effect, and exploitation is restricted by the authentication prerequisite; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited.
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Authorization bypass in the Content Egg affiliate importer plugin for WordPress (all versions up to and including 12.0.0) lets an authenticated user with author-level access or above create posts that WordPress records as authored by a different account - typically an administrator - by supplying a preset_id owned by that administrator to the plugin's import routine. When the attacker also holds publish_posts capability for the preset's post type, the resulting administrator-attributed content can be published rather than left as a draft, damaging authorship integrity on the site. The flaw is remote and low-complexity but requires a valid low-privileged account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3); there is no confidentiality or availability impact, no public exploit code or PoC reference was identified at time of analysis, and it is not in CISA KEV. Our assessment rates it a genuine but modest-severity issue best handled as a routine-priority fix.
Missing per-post authorization in the Content Egg affiliate product importer plugin for WordPress (versions up to and including 12.0.0) allows an authenticated user with contributor-level access or above to overwrite Content Egg product data and update-timestamp post meta on arbitrary posts, including posts owned by administrators. The ajaxUpdateProducts() handler validates a static 'contentegg_metabox' nonce and the generic edit_posts capability, then trusts the attacker-supplied post_id without ever calling current_user_can('edit_post', $post_id). Impact is limited to integrity (I:L) with no confirmed confidentiality or availability effect, and exploitation is restricted by the authentication prerequisite; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited.