CVE-2026-13200 in Create Plugin
Summary
by MITRE • 09/19/2026
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The Create plugin for WordPress contains a critical security flaw classified as an SQL Injection vulnerability within its advanced filtering functionality. This issue affects all versions up to and including 2.5.3. The root cause of the vulnerability lies in insufficient input validation and sanitization mechanisms applied to user-supplied data, specifically targeting the order parameter used during database query construction. Because the application fails to properly escape special characters or utilize prepared statements with bound parameters for this specific input vector, it allows malicious actors to inject arbitrary SQL commands directly into the backend database queries executed by the WordPress environment.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and system compromise. An attacker must possess authenticated access at the author level or higher within the WordPress installation to exploit this flaw. While this requirement limits the attack surface compared to unauthenticated vulnerabilities, it remains a serious threat as many legitimate users hold such privileges. By exploiting the lack of sufficient preparation on existing SQL queries, an authorized user can append additional SQL statements that are executed alongside the intended query logic. This capability enables the extraction of sensitive information from the database, including administrative credentials, user data, and other confidential content stored within the WordPress backend.
The vulnerability is specifically triggered when specific parameters related to advanced filtering are present in the HTTP request. The vulnerable code path is entered only if at least one of the following parameters appears: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type. When these parameters are included alongside the manipulated order parameter, the application processes them without adequate security checks, leading to the execution of injected SQL code. This conditional entry point suggests that the vulnerability is localized to specific administrative workflows involving content filtering and sorting rather than being present in every possible interaction with the plugin.
From a classification perspective, this flaw aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, which describes failures to neutralize special elements within SQL commands that could alter their intended meaning. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Data from Information Repositories and potentially Credential Access if administrative hashes are extracted. The exploitation relies on the principle of insufficient input validation where trusted roles do not guarantee safe handling of dynamic query components.
Mitigation strategies should prioritize immediate remediation through software updates or manual code patching for affected installations. Administrators running versions up to 2.5.3 must upgrade to a patched version that implements proper parameterized queries and strict type checking for the order parameter. Until an update is applied, restricting administrative access to only essential personnel can reduce the risk of exploitation. Additionally, implementing Web Application Firewalls with rules capable of detecting SQL injection patterns in POST or GET parameters may provide a layer of defense against attempted exploits targeting this specific vector within the WordPress ecosystem.