The vulnerability occurs because the ajax update function in Content Egg trusts an attacker‑supplied post identifier and only verifies a global capability instead of performing a per‑object check. An authenticated user with contributor rights or higher can therefore modify the product meta fields (_cegg_data_*) and update timestamps on any post, including those owned by administrators. This capacity to alter post metadata without proper authority may allow content manipulation or tampering with pricing data, potentially undermining the integrity of an e‑commerce site.

The affected product is the Content Egg – Affiliate Product Importer & Price Comparison plugin from keywordrush. All releases up to and including version 12.0.0 contain the flaw; users running these or earlier versions are vulnerable.

The CVSS score of 4.3 indicates a moderate severity, and no EPSS data is available, suggesting limited knowledge of exploitation attempts. The vulnerability is not listed in the CISA KEV catalog. Attackers need only be authenticated on the WordPress site and possess contributor or higher privileges to exploit this flaw via the cegg_update_products AJAX action. Given the potential for widespread data tampering, the risk remains significant when contributors are granted to untrusted users.