Executive brief
The Mediavine Create plugin for WordPress contains a SQL injection vulnerability in its filter functionality that allows authenticated authors and higher-level users to inject malicious SQL commands. An attacker with author-level access could extract sensitive data from the WordPress database, including user credentials and other confidential information stored within the site.
Technical details
The plugin fails to properly escape and prepare the 'order' parameter in SQL queries, allowing authenticated attackers to inject arbitrary SQL. The vulnerability is triggered when specific filter parameters (linked_posts, created_after, created_before, missing_fields, post_id, type values, or exclude_type) are present in the request. An attacker with author-level permissions can read sensitive database contents through UNION-based or time-based SQL injection techniques.
Affected products
- Mediavine Create up to 2.5.3
Timeline
- 2026-09-19: disclosed