CVE-2026-16992
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Create WordPress plugin before version 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.
Risk Assessment
The risk involves disclosure of unpublished content, which may compromise data confidentiality and integrity, and harm the organization's reputation.
Recommendation
It is recommended to immediately update the Create plugin to version 2.5.4 or later, which includes the security fix.
Other vulnerabilities in Create WordPress plugin
See all- CVE-2026-13200Medium
The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.
- CVE-2026-13191Medium
The Create plugin for WordPress in all versions up to and including 2.5.3 is vulnerable to generic SQL Injection via the 'order_by' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.
- CVE-2026-18037Medium
The Create WordPress plugin before version 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.
Original NVD description (English source)
The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS