CVE-2026-13200

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4

Description An issue exists where authenticated attackers with author-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database via the order parameter. This specific execution path is triggered when the request includes at least one of the following parameters: linked posts, created after, created before, missing fields, post id, a comma-separated type value, or exclude type.

Recommendations Update the Create plugin for WordPress to version 2.5.4 or later. As a temporary mitigation, restrict author-level access or avoid using the order parameter in conjunction with linked posts, created after, created before, missing fields, post id, or exclude type until the update is applied.