CVE-2026-125046: WordPress Create plugin <= 3.1.1 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects the Create WordPress plugin, identified as mediavine-create, through version 3.1.1. The available data does not state a fixed version.

Q: What level of access does an attacker need?

The supplied severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact if exploited?

The severity vector indicates low confidentiality impact, with no integrity or availability impact listed.

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Create plugin to a version that resolves this vulnerability.
Fixed in 3.1.2

Event History

Nov 11, 2026

CVE Published

via MITRE·01:02 PM

Data Sourced

via MITRE·01:02 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects the Create WordPress plugin, identified as mediavine-create, through version 3.1.1. The available data does not state a fixed version.

What level of access does an attacker need?

The supplied severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact if exploited?

The severity vector indicates low confidentiality impact, with no integrity or availability impact listed.

CVE-2026-125046: WordPress Create plugin <= 3.1.1 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the expected impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the expected impact if exploited?