---
id: CVE-2026-13191
title: >-
  The Create plugin for WordPress is vulnerable to generic SQL Injection via the
  'order_by' parameter in all versions up to, and including, 2.5.3 due to
  insufficient escaping on the user supplied parameter and lack of sufficient
  preparatio…
summary: >-
  The Create plugin for WordPress is vulnerable to generic SQL Injection via the
  'order_by' parameter in all versions up to, and including, 2.5.3 due to
  insufficient escaping on the user supplied parameter and lack of sufficient
  preparatio…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: mischiefmarmot
product: Create
affected:
  - Create <= 2.5.3
published: '2026-09-19'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13191'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/class-api-services.php#L191
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/class-permissions.php#L22
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1183
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1586
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/db-interface/class-mv-dbi.php#L1646
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/mediavine-create/tags/2.5.2/lib/products/class-products.php#L533
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3627606%40mediavine-create&new=3627606%40mediavine-create
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/46fa99f1-9152-4130-a5b1-2ea10032069b?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00281
epssPercentile: 0.20884
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-19T13:23:56.695986Z'
ingestedAt: '2026-09-19T07:59:56.112Z'
---

## Overview

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.