What is the CVSS score of CVE-2026-24552?

CVE-2026-24552 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Create by Mediavine are affected by CVE-2026-24552?

WordPress sites using Mediavine Create plugin (versions ≤2.5.3) face credential and encryption key theft: internal contributors with minimal privilege can extract the entire database, including…

How to fix or mitigate CVE-2026-24552?

Within 24 hours: identify WordPress instances running Mediavine Create and audit all accounts with Contributor privilege or above; disable the plugin immediately if confirmed in production. Within 7 days: restrict Contributor-level access to essential personnel only, enable WordPress database query logging and alert on SQL metacharacters in plugin requests, and implement a Web Application Firewall rule to filter injection attempts if plugin removal is not feasible. Within 30 days: evaluate replacement recipe plugins, prepare a forensic database audit procedure to detect if credentials or keys were extracted, rotate WordPress database passwords and authentication keys as a precautionary measure, and enforce principle-of-least-privilege controls to prevent future privilege creep.

Create by Mediavine CVE-2026-24552

EUVD-2026-48144 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-9299-rf7x-c527

WordPress SQLi Wordpress Plugin Create By Mediavine

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Contributor account required (PR:L) and network-reachable with low complexity; SQLi confined to the site database (S:U) yielding full read (C:H) and limited write (I:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:15 vuln.today

CVE Published

Jul 23, 2026 - 11:17 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.

AnalysisAI

SQL injection in the Create by Mediavine (Mediavine Create) WordPress recipe plugin through version 2.5.3 allows authenticated users holding at least Contributor-level privileges to inject arbitrary SQL into backend database queries (CWE-89). Successful exploitation exposes the full WordPress database - including user credentials, secret keys, and site content - and the CVSS 3.1 scope-changed vector (S:C) indicates impact beyond the plugin's own security context. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Create by Mediavine is a WordPress plugin (CPE cpe:2.3:a:mischiefmarmot:create_by_mediavine) that adds recipe, how-to, and list card functionality for content/food publishers. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input reachable by Contributor accounts is concatenated into a SQL statement without proper parameterization or sanitization, letting the attacker alter query structure. Because WordPress plugins execute against the shared site database via $wpdb, an injection typically grants read access to the entire schema (wp_users, wp_usermeta, wp_options) rather than a single plugin table, which aligns with the reported confidentiality-high, scope-changed rating.

RemediationAI

Upgrade the Create by Mediavine plugin to the first release published after 2.5.3 (the fixed version is not stated in the provided data, so confirm the exact patched version on the Patchstack advisory and the WordPress.org plugin page before deploying). If an immediate update is not possible, apply compensating controls: restrict or audit who holds Contributor or higher roles and disable open user registration (Settings > General > 'Anyone can register') to remove the required privilege level; deactivate the plugin if recipe functionality is non-essential, accepting loss of recipe cards on published posts; and place a WAF/virtual patch rule (Patchstack, Wordfence) in front of the vulnerable endpoint to block SQLi payloads, accepting possible false positives on legitimate recipe input. Refer to the vendor advisory: https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-2-5-3-sql-injection-vulnerability.