WordPress security changelog
MEDIUM CVE-2026-13191 Deferred

Create REST ordering identifiers are vulnerable to SQL injection

An Author or higher role can reach a REST endpoint whose permission callback defaults to publish_posts and supply SQL through order_by. The unescaped, unprepared value reaches a database query and can expose sensitive information. No additional advanced-filter prerequisite is stated for this CVE. The exact REST route and query function are not disclosed. Authoritative affected range: <= 2.5.3. Confirmed remediation: 2.5.4.

CVE / CNA score 6.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Create
Plugin slug
mediavine-create
Affected
<= 2.5.3
Safe version
2.5.4
Published
Sep 19, 2026
Weakness
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

This CVE was published Sep 19, 2026 and is one of 9 known issues for this plugin.

What to do

Update, patch or deactivate.

Confirmed fixed release: 2.5.4. The changelog explicitly names CVE-2026-13200 and CVE-2026-13191 as fixed SQL injection issues. Official changelog: https://wordpress.org/plugins/mediavine-create/#developers . Map allowed ordering fields to fixed SQL identifiers rather than interpolating caller-supplied identifiers; prepare remaining values and retain the intended capability check. Restrict affected REST queries until updated.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources