Executive brief
The Create plugin for WordPress, used to manage content on WordPress websites, contains a SQL injection vulnerability that allows authenticated authors to extract sensitive data from the website database. An attacker with author-level access or higher can exploit the 'order_by' parameter to run arbitrary SQL queries and steal information like usernames, passwords, or other sensitive database contents.
Technical details
The vulnerability is a generic SQL injection in the 'order_by' parameter due to insufficient input escaping and lack of prepared statements. The REST endpoint permission callback defaults to publish_posts capability, allowing any author-level user to access the vulnerable code path. Authenticated attackers with author-level access and above can inject additional SQL queries to extract sensitive data from the database.
Affected products
- Mediavine Create up to and including 2.5.3
Timeline
- 2026-09-19: disclosed