CVE-2026-13191

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4

Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escaped and the SQL query is not properly prepared. Attackers can append additional SQL queries to extract sensitive information from the database. The vulnerability is accessible via a REST endpoint where the permission callback defaults to the publish posts capability.

Recommendations Update the Create plugin for WordPress to version 2.5.4 or later. Avoid using the order by parameter in the affected REST endpoint until the update is applied.