Create public REST rendering route reads and publishes unpublished content
Create before 2.5.4 does not authorize a request before rendering content through a public REST API route. An unauthenticated attacker can request unpublished content and the route publishes that content as a side effect, both disclosing it and changing its visibility.
- Component
- Create
- Plugin slug
mediavine-create- Affected
- < 2.5.4
- Safe version
2.5.4- Published
- Aug 09, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 09, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
Update to 2.5.4 or later. Review publication status and revision history for content that should remain private, restore affected visibility settings, and inspect REST request logs for unauthorized rendering requests.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N