CVE-2026-13191
MediumCVSS 6.5Summary
The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order_by' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.
Risk Assessment
An authenticated attacker with author-level access or above can append additional SQL queries into existing queries, enabling extraction of sensitive information from the database.
Recommendation
Update the Create plugin to a version newer than 2.5.3 once available, and restrict Author roles on the site to the necessary minimum.
Other vulnerabilities in Create WordPress plugin
See all- CVE-2026-13200Medium
The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.
- CVE-2026-18037Medium
The Create WordPress plugin before version 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.
- CVE-2026-16992Medium
The Create WordPress plugin before version 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.
Original NVD description (English source)
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.