CVE-2026-18037mediumCWE-862

CVE-2026-18037: medium-severity vulnerability in Create

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

Published · Updated

Follow this CVE+ Monitor Create

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.3%
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Create
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Create

In the same product, most dangerous first.

CVE-2026-16992MEDIUMCreate by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and PublicationEPSS 0.3%