# CVE-2026-24552: Mediavine Create SQL injection in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-24552-mediavine-create-sql-injection-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-24552 · Severity: high · CVSS 8.5 · Published 2026-07-23

Create by Mediavine is a WordPress plugin used by content creators to build and display recipe cards, craft instructions, and lists. A security flaw allows users with 'Contributor' level access to perform unauthorized database queries. This could lead to the exposure of sensitive site information or disruption of website operations.

Technologies: [Mediavine Create](https://junglewise.ai/threats/technologies/create). Vendors: [Mediavine](https://junglewise.ai/threats/vendors/mediavine).

## Quick answers

**Is CVE-2026-24552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24552 being exploited in the wild.

**How severe is CVE-2026-24552?** High severity, with a CVSS score of 8.5, published 23 July 2026.

**Which products and versions are affected?** Mediavine Create <= 2.5.3.

**Is there a fix for CVE-2026-24552?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24552 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-24552?** Check whether you run Mediavine Create at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Create by Mediavine plugin for WordPress (versions <= 2.5.3) contains a SQL injection vulnerability due to improper neutralization of special elements used in an SQL command (CWE-89). The vulnerability requires 'Contributor' level authentication (PR:L) and can be exploited over the network without user interaction. An attacker with these privileges can execute arbitrary SQL queries against the WordPress database, potentially leading to sensitive data exfiltration or limited service disruption. As of the advisory date, no official patch has been released.

## Affected products

- Mediavine Create by Mediavine <= 2.5.3

## Timeline

- 2025-12-24: other: Vulnerability reported by researcher Nabil Irawan
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD dataset

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-2-5-3-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-2-5-3-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Mediavine Create plugin SQL injection in order parameter](https://junglewise.ai/threats/cve-2026-13200-the-create-plugin-for-wordpress-is-vulnerable-to-generic-sql)
- [Mediavine Create SQL injection in order_by parameter](https://junglewise.ai/threats/cve-2026-13191-the-create-plugin-for-wordpress-is-vulnerable-to-generic-sql)