rootpwn

medium · CVSS v3 6.5 · EPSS 0.00249

CVE-2026-13200

WordPress Create plugin versions up to 2.5.3 are vulnerable to SQL injection via the 'order' parameter. Authenticated users with author-leve

Overview

WordPress Create plugin versions up to 2.5.3 are vulnerable to SQL injection via the 'order' parameter. Authenticated users with author-level access can inject SQL to read sensitive database data. This could expose confidential site information.

Description

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.

Impact

Confidentiality: attackers can read arbitrary database tables. Integrity: potential for data tampering if further privileges are obtained. Availability: not directly affected. Impacted users: site administrators and authors with access to the plugin.

Remediation

Update the Create plugin to version 2.5.4 or later. If an update is not possible, disable the plugin or restrict author-level access. Validate and escape the 'order' parameter on the server side.

Risk context

The vulnerability has a medium severity rating (CVSS 6.5) and an EPSS score of 0.00249, indicating a low likelihood of exploitation but still warranting prompt patching.

Affected products

  • WordPress
  • Create plugin

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
0.00249

wordpress sql-injection plugin authentication database

← All CVEs

Related CVEs

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-93957

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-12402

The OTP Login & Register WooCommerce plugin for WordPress is vulnerable to stored XSS via the 'fb-config' setting. Authenticated administrators can inject scripts that execute for any user who views the affected page, enabling session hijacking or site defacement.

View analysis

medium

CVE-2026-13191

The Create plugin for WordPress (v2.5.3 and earlier) contains a SQL injection flaw in the order_by parameter that can be exploited by users with author-level or higher privileges. Attackers can inject arbitrary SQL to read sensitive database data. This vulnerability is exploitable via the REST API endpoint that defaults to publish_posts capability.

View analysis