CVE-2026-18037
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Create WordPress plugin before version 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.
Risk Assessment
The risk involves disclosure of unpublished content, which may compromise data confidentiality and integrity, and harm the organization's reputation.
Recommendation
It is recommended to immediately update the Create plugin to version 2.5.4 or later, which includes the security fix.
Original NVD description (English source)
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.