The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress has a flaw that allows an authenticated user with author or higher privileges to create posts that are assigned to another user, typically an administrator. The vulnerability arises because the plugin does not validate that the user has permission to specify the preset_id parameter when requesting a post import. By supplying a preset_id that belongs to an administrator, an attacker can trigger wp_insert_post with the administrator’s user ID, leading to published content that appears to originate from a higher‑privileged account.

All installations of the keywordrush Content Egg plugin version 12.0.0 and earlier are affected. A WordPress site running any of these vulnerable versions remains exposed until the plugin is updated.

The CVSS score of 4.3 classifies this issue as medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least author capability, and the attacker must know or guess a preset_id that belongs to an administrator. Once the conditions are met, the attacker can publish posts under the administrator’s identity, bypassing normal authorship controls.