EUVD-2026-54876
GHSA-m73c-99g6-hrp8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible public REST route, no auth or interaction required; limited to content disclosure and unintended publication, no availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
AnalysisAI
Missing authorization on a public REST API route in the Create WordPress plugin before 2.5.4 exposes unpublished content to unauthenticated remote attackers and permanently publishes it as a side effect of the read request. Any WordPress site running an affected version of this plugin may have draft, scheduled, or private posts silently promoted to public visibility without any author or administrator action. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) signals low current exploitation interest, though the trivially low attack complexity makes opportunistic targeting straightforward once the endpoint is known.
Technical ContextAI
The vulnerability resides in the Create WordPress plugin's custom REST API implementation, affecting all versions prior to 2.5.4. WordPress plugins can register public REST API routes accessible without authentication; the flaw (CWE-862, Missing Authorization) occurs because the affected route omits the standard WordPress capability check before processing the request. Beyond simply returning data, the route triggers a content-publication side effect, meaning a GET-style lookup inadvertently calls WordPress's post-publishing internals and changes post status from 'draft', 'pending', or 'private' to 'publish'. The CPE-equivalent affected range is Create plugin versions 0 through below 2.5.4. The dual nature of the bug - information disclosure combined with unintended state mutation - arises from improper separation of read and write logic in the route handler.
RemediationAI
Update the Create WordPress plugin to version 2.5.4 or later, which is confirmed available from the vendor per WPScan advisory at https://wpscan.com/vulnerability/cd61ce2a-94ce-4ce3-a592-b7329f118f94/. WordPress site administrators can update via the Plugins dashboard (Dashboard > Plugins > Update Available) or using WP-CLI: wp plugin update create. If an immediate update is not feasible, a short-term compensating control is to disable the Create plugin entirely via the WordPress admin panel until patching is possible - this removes the vulnerable REST route at the cost of losing the plugin's functionality. Alternatively, a WAF rule blocking unauthenticated requests to the specific affected REST API path (identifiable by reviewing the plugin's route registration code) can mitigate exploitation without disabling the plugin, though this requires knowing the exact endpoint path and may not survive plugin updates. There is no evidence that restricting general REST API access site-wide is necessary or appropriate.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today