Attack Chain

1. The contributor harvests the cegg_import nonce from their own post-new.php UI.
2. The contributor submits a POST request to wp-admin/admin-ajax.php with the action cegg_import_enqueue.
3. The request specifies a preset_id (created by an administrator) and a malicious JSON payload containing script tags in the title or description.
4. The ImportQueueApi::handle_enqueue() function validates access as edit_posts, which the contributor possesses.
5. The background worker (ProductImportService.php) loads the selected preset.
6. The system executes wp_set_current_user() to switch identity to the preset author (the administrator).
7. The wp_insert_post() function is called, and because the user context is now an administrator, the unfiltered_html capability allows the script tag to be stored raw.
8. The script executes in the context of any administrator or editor who previews the draft, or in the browser of any visitor if the post is published.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of privileged users, enabling session hijacking, CSRF nonce exfiltration, account takeover, or site-wide defacement. The attack is misattributed to the impersonated administrator, complicating incident response.

Recommendation

1. Upgrade the Content Egg plugin to version 11.9.0 or later immediately.
2. Audit existing Import Presets for unauthorized modifications or suspicious content.
3. Audit high-privileged user accounts for unauthorized posts or drafts created via the Content Egg plugin.