Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• wordpress.org/plugins/content-egg Yama
• vulncheck.com/…cated-information-disclosure-via-render-blocks Üçüncü taraf

Kayıt geçmişi

1. 5 Kas 2026 18:35Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-119059Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'p…
• 4,3 CVE-2026-119087Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
• 8,8 CVE-2026-77439Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
• 4,3 CVE-2026-104867Immich calendar heatmap endpoint discloses cross-user activity through broken access control
• 9,0 CVE-2026-54141OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
• 6,6 CVE-2026-111253Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction