The Create WordPress plugin lacks an authorization check on one of its REST API routes, allowing anyone who can reach the site to retrieve content that has not yet been published. Once requested, the same route also publishes that requested content, preventing further restriction. This means an unauthenticated attacker can both view and later make visible drafts, posts, or other unpublished data, compromising confidentiality and potentially damaging the site’s trustworthiness.

Any WordPress installation running the Create plugin version 2.5.3 or older is affected. The plug‑in must be upgraded to 2.5.4 or newer; no other vendors or products are currently listed as impacted.

The vulnerability is exploitable over the public network and requires no special privileges or code execution. Although no EPSS score is available and the issue is not in the CISA KEV catalog, the absence of authentication means an attacker can trigger the disclosure with a simple HTTP request. The side effect of permanently publishing the content raises the risk from transient disclosure to sustained exposure, resulting in moderate to high impact for sites that rely on unpublished drafts.