EUVD-2026-54891
GHSA-66mx-cjh4-m7cx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable REST route requires no authentication or user interaction; confidentiality and integrity limited to draft content read and unintended publication; no availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
AnalysisAI
Unauthenticated remote access to unpublished WordPress content is possible through a missing authorization check in the Create plugin (all versions before 2.5.4), with the compounding side effect that accessing the vulnerable REST API route also forces the requested content to be published publicly. Both the confidentiality breach (reading private drafts) and the integrity violation (forced publication) occur in a single unauthenticated request, making this a dual-impact flaw affecting any WordPress site with the plugin installed below version 2.5.4. No public exploit has been identified at time of analysis, and EPSS is low at 0.14% (3rd percentile), though the zero-barrier network vector warrants prompt patching on content-sensitive sites.
Technical ContextAI
The Create WordPress plugin registers custom REST API routes within the WordPress REST framework. CWE-862 (Missing Authorization) describes the root cause: the affected route handler fails to implement a permission_callback or equivalent capability check (e.g., current_user_can()) before processing requests. WordPress REST API routes are publicly routable by default unless explicitly restricted, so any unauthenticated HTTP client can reach the endpoint. The secondary vulnerability is the route's side-effect behavior - rather than only reading content, the handler triggers a publish action on the requested post object, meaning a single GET-style request produces both an information disclosure and an unintended state change. Affected versions are all Create plugin releases from 0 up to but not including 2.5.4, as confirmed by WPScan (EUVD-2026-54891) and NVD.
RemediationAI
Update the Create WordPress plugin to version 2.5.4 or later, which is the vendor-released patch as referenced by WPScan (https://wpscan.com/vulnerability/d85653f7-8556-4bac-8860-fbacc63ba5df/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16992). The update is available through the standard WordPress plugin repository. If immediate upgrade is not possible, the most effective compensating control is to disable the Create plugin entirely until patching can be scheduled - this eliminates the vulnerable REST routes at the cost of losing plugin functionality. Alternatively, a WordPress security plugin or Web Application Firewall rule blocking unauthenticated access to the specific REST API namespace introduced by Create can mitigate exposure without disabling the plugin, though the exact route path must be identified from plugin source to write an accurate rule. Restricting the WordPress REST API globally to authenticated users is a broader workaround but carries the trade-off of breaking other legitimate REST-dependent functionality such as Gutenberg editor features and third-party integrations.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today