What is the CVSS score of CVE-2026-65490?

CVE-2026-65490 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Create by Mediavine CVE-2026-65490

Q: Which versions of Create by Mediavine are affected by CVE-2026-65490?

Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted.

EUVD-2026-48101 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-23 Patchstack

GHSA-qmj8-gc4f-cmv3

WordPress Information Disclosure Wordpress Plugin Create By Mediavine

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication or interaction; confidentiality impact is Low as only partial or non-critical data is exposed; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:19 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.

Technical ContextAI

Create by Mediavine (CPE: cpe:2.3:a:mischiefmarmot:create_by_mediavine) is a WordPress plugin providing recipe card and structured content creation functionality for publishers and food bloggers. The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which describes scenarios where software inadvertently exposes internal or sensitive operational data - such as configuration details, internal API keys, user data, or system metadata - to actors who should not have access. In WordPress plugin context, this type of flaw typically manifests through unprotected REST API endpoints, publicly accessible AJAX handlers, or inadequately access-controlled data output that returns sensitive content without verifying the requestor's identity or authorization level.

RemediationAI

Update the Create by Mediavine plugin to a version beyond 2.5.3 via the WordPress plugin dashboard or the official WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-2-5-3-sensitive-data-exposure-vulnerability should be consulted for the confirmed fixed version, as an exact patched release version was not explicitly identified in the available source data. If an immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface, accepting the trade-off of losing recipe card functionality. Additionally, a Web Application Firewall (WAF) rule targeting the specific vulnerable endpoint - once identified from the Patchstack advisory - could serve as a compensating control, though this is not a substitute for patching.