Mediavine Create EUVD-2026-83543

Requires an authenticated WordPress account with Author-level access or above - specifically the publish_posts capability, which is the default requirement of the vulnerable REST endpoint's permission callback, so no additional privilege or configuration is needed once that role is held. The attack targets the 'order_by' parameter of the plugin's REST/API-driven database query (class-mv-dbi.php order-by handling reached via class-api-services.php) in Mediavine Create versions up to and including 2.5.3. Limiting factors: exploitation is impossible for anonymous/Subscriber-level users, so sites that do not grant Author or higher to untrusted parties are not practically exposed; no user interaction or non-default configuration is required beyond having the plugin installed and active.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: a network-reachable, low-complexity SQL injection reachable by any Author-level (publish_posts) account, yielding high confidentiality impact (database extraction) with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation and should not be treated as such. The key limiting factor is PR:L: an attacker must first hold at least Author-level access, which meaningfully narrows the population of exploitable sites to those that provision Author accounts to semi-trusted users (multi-author blogs, membership sites). Weighed together, this is a genuine but moderate-priority issue: real and directly exploitable once an Author foothold exists (a common privilege level on content sites), but not a mass-exploitable unauthenticated flaw. Patch prioritize on multi-author WordPress installations running Mediavine Create; single-admin sites face lower practical exposure. No signals conflict; the main gap is absence of EPSS/KEV/POC data, which is consistent with a recently disclosed, not-yet-weaponized vulnerability.

An attacker who holds (or registers/obtains) an Author-level account on a WordPress site running Mediavine Create sends an authenticated REST API request with a malicious 'order_by' value, appending a UNION-based or sub-query SQL payload to the plugin's underlying query. Because the query lacks proper preparation/escaping, the injected SQL executes and returns sensitive data such as user records and password hashes from the WordPress database. No public exploit code is identified at time of analysis, but SQLi via an ORDER BY parameter is straightforward to weaponize with standard tooling.