Mediavine Create CVE-2026-13200

Requires an authenticated WordPress account with author-level capabilities or higher on a site running the Create (Mediavine Create) plugin version 2.5.3 or earlier. Exploitation additionally requires that the request enter the advanced-filter SQL branch, which is only reached when at least one of these parameters is present: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated 'type' value, or exclude_type. The injection itself is performed via the 'order' parameter. Limiting factors: the author role is a trusted, non-default-public role (not available to anonymous users or ordinary subscribers), and the specific filter parameters must be supplied, so exploitation is not reachable against a default anonymous request.

This is a moderate-priority, authenticated SQL injection. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) is internally consistent: network-reachable, low complexity, but requiring privileges (PR:L). The key mitigating factor is the authentication barrier - the description confirms author-level access or above is required, which is a meaningfully privileged WordPress role not available to anonymous visitors or self-registered subscribers. C:H with I:N/A:N correctly reflects a read-oriented injection used to extract sensitive data (e.g., user hashes, secrets in wp_options) rather than modify or destroy it. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is: no public exploit identified at time of analysis. There is no SSVC data supplied. The main signal tempering raw severity is the required author-level trust plus the narrow trigger condition (the vulnerable advanced-filter branch is only reached when specific filter parameters are present), which lowers the odds of opportunistic, automated mass exploitation compared to an unauthenticated SQLi.

An attacker who has obtained or been granted an author-level WordPress account (or higher) on a site running Create <=2.5.3 sends a request to the creations advanced-filter API that includes a triggering parameter such as post_id or a comma-separated type value, while injecting crafted SQL into the unescaped 'order' parameter. Because the order clause is concatenated into the query without proper preparation, the attacker appends a UNION/subquery to exfiltrate password hashes, secret keys, or other sensitive rows from the database. No public exploit code was identified at the time of analysis, but the injection point is straightforward for anyone with the required account.