The Create plugin for WordPress, in versions prior to 2.5.4, contains a flaw in one of its public REST API routes. That route fails to perform an authorization check before rendering content. Additionally, the same route has a side effect that forces the requested content to be published. As a result, unauthenticated attackers can read unpublished content through the API and can cause that content to be made publicly visible. The vulnerability represents a breach of confidentiality and loss of control over content lifecycle, corresponding to CWE‑284 and CWE‑200.

Any WordPress installation that has the Create plugin (by Mediavine or otherwise) installed with a version older than 2.5.4. Since the vendor field is unknown, any web site using the Create plugin before that release is potentially impacted. No specific operating system or platform restrictions are mentioned.

The affected API endpoint is publicly exposed and does not require any credentials, so the attack vector is network-bound: an attacker can send HTTP requests to the endpoint from a remote location. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation data. The CVSS score is not disclosed, but the lack of authentication and the potential for mass publication suggest a high impact. Without patching the plugin, attackers can continuously read and publish content until the site owner takes remedial action.