We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-16992

CVE-2026-16992

WordPress

Severity: —
CVSS: —CVSS
Published: 2026-08-09
Last modified: 2026-08-09

Description

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

References

https://wpscan.com/vulnerability/d85653f7-8556-4bac-8860-fbacc63ba5df/

Summary

Description

References