The Create plugin for WordPress, in versions prior to 2.5.4, contains a flaw in one of its public REST API routes. That route fails to perform an authorization check before rendering content. Additionally, the same route has a side effect that forces the requested content to be published. As a result, unauthenticated attackers can read unpublished content through the API and can cause that content to be made publicly visible. The vulnerability represents a breach of confidentiality and loss of control over content lifecycle, corresponding to CWE‑862.

Any WordPress installation that has the Create plugin installed with a version older than 2.5.4 may be affected. No specific operating system or platform restrictions are mentioned.

Based on the description, it is inferred that the likely attack vector is network‑bound: an attacker can send HTTP requests to the affected REST API endpoint from a remote location. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation data. The CVSS score of 6.5 indicates a medium to high impact. Without patching the plugin, attackers can continuously read and publish content until the site owner takes remedial action.