Description

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T08:16:52.050Z",
  "pubdate": "2026-09-19T08:16:52.050Z",
  "executiveSummary": "The Create plugin for WordPress is susceptible to an authenticated SQL injection vulnerability affecting all versions up to and including 2.5.3.\nThe vulnerability arises from improper sanitization and lack of parameterized queries when processing the 'order_by' parameter within a REST API endpoint.\nAn attacker possessing 'author' level privileges or higher can manipulate database queries to execute arbitrary SQL commands.\nThe potential impact includes unauthorized access to sensitive database information, data exfiltration, and potential manipulation of application data.\nThe vulnerability is accessible due to an insecurely configured REST endpoint permission callback, which defaults to the 'publish_posts' capability.\nExploitation does not require additional preconditions beyond authenticated access, representing a significant security risk to the integrity and confidentiality of the WordPress environment.",
  "technicalDetails": "The vulnerability is classified as a generic SQL injection occurring within the Create plugin's REST API implementation. The root cause is the failure to utilize adequate input sanitization or parameterized queries when handling the 'order_by' parameter before integrating it into a database query.\nThe REST endpoint responsible for processing these requests relies on a permission callback that defaults to the 'publish_posts' capability. This architectural oversight permits any authenticated user with an 'author' role or higher to reach the vulnerable code path.\nIn a typical attack flow, an authenticated user sends a crafted HTTP request to the vulnerable REST endpoint. By injecting malicious SQL syntax into the 'order_by' parameter, the attacker can break out of the intended query structure. Because the application fails to properly escape this input, the database engine executes the injected SQL commands as part of the primary query.\nThe payload behavior involves the manipulation of the ORDER BY clause to append subqueries or UNION-based statements. This allows the attacker to extract sensitive information stored in the WordPress database, such as user credentials, configuration data, or plugin-specific proprietary content.\nThe lack of preparation in the existing SQL query allows for the injection of arbitrary SQL logic, extending the attacker's capabilities beyond simple data retrieval to potential data modification depending on the database user's privileges and the structure of the injected query.\nBecause the vulnerability exists within a REST endpoint, the attack is performed over standard HTTP/HTTPS protocols. The exploitation process is deterministic and does not require complex reconnaissance beyond identifying the target endpoint and the associated parameter.\nPost-exploitation, an attacker could potentially escalate privileges, dump the entire database contents, or modify data to maintain persistence within the WordPress installation. The severity is heightened by the ease of access provided by the insufficient permission checks inherent in the endpoint configuration."
}