CVE-2026-16992: Create WordPress Auth Bypass Vulnerability

CVE-2026-16992 Overview

CVE-2026-16992 is a missing authorization vulnerability [CWE-862] affecting the Create WordPress plugin before version 2.5.4. The plugin exposes a REST API route that fails to verify caller permissions before returning content. The same route publishes the requested content as a side effect. Unauthenticated attackers can read unpublished posts and force them to become publicly available on the site.

Critical Impact
Remote unauthenticated attackers can disclose draft or private content and change its status to published without any credentials or user interaction.

Affected Products

Create WordPress plugin versions prior to 2.5.4
WordPress sites with the vulnerable plugin activated
Any content stored in unpublished states (draft, pending, private) managed by the plugin

Discovery Timeline

2026-08-09 - CVE-2026-16992 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-16992

Vulnerability Analysis

The Create WordPress plugin registers a REST API route that returns content on request. The route handler does not call an authorization callback or run a capability check before serving the response. Any unauthenticated client can invoke the route and retrieve content that the site owner has not published.

The same route publishes the requested content as a side effect of the read operation. A single unauthenticated request therefore both discloses the content and changes its visibility to public. This combines an information disclosure flaw with an unauthorized state-change flaw in one request path.

The issue is scoped to confidentiality and integrity impact, with no direct availability impact. The impacted content includes drafts, scheduled posts, and other non-public items managed through the plugin.

Root Cause

The root cause is a missing authorization check [CWE-862] in the REST API route registration. The plugin relies on the route being unknown to external users rather than enforcing capability checks such as current_user_can( 'read_private_posts' ) or a permission_callback on the register_rest_route() call. WordPress REST routes are discoverable through the site index, so obscurity provides no protection.

Attack Vector

An attacker sends an HTTP request directly to the affected REST endpoint over the network. No authentication, session, or user interaction is required. The attacker specifies the identifier of the target content in the request. The plugin returns the content body in the JSON response and marks the item as published in the database. The item then becomes visible to any visitor of the site.

The vulnerability manifests in the REST route handler in the Create plugin. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-16992

Indicators of Compromise

Unexpected HTTP requests to /wp-json/ routes exposed by the Create plugin from unauthenticated sources
Posts that transitioned from draft, pending, or private to publish without a corresponding authenticated admin session
WordPress audit log entries showing status changes with no associated user ID
Access log entries containing the plugin's REST namespace originating from unknown IP addresses

Detection Strategies

Review web server access logs for anonymous GET requests to REST endpoints registered by the Create plugin
Correlate post status transitions in the wp_posts table with authenticated session activity to find orphaned publish events
Alert on responses from /wp-json/ paths returning content bodies to clients that did not authenticate
Compare current published post counts against baseline values to identify unexpected content exposure

Monitoring Recommendations

Ingest WordPress access logs and application logs into a centralized SIEM for correlation and retention
Monitor for spikes in requests to plugin REST namespaces from single IP addresses
Track database changes to the post_status column and flag transitions to publish outside of admin workflows
Enable file integrity monitoring on the plugin directory to detect tampering or downgrade attempts

How to Mitigate CVE-2026-16992

Immediate Actions Required

Update the Create WordPress plugin to version 2.5.4 or later on all affected sites
Audit all posts and custom post types for unexpected publish status transitions and revert unauthorized publications
Rotate any credentials or tokens that may have been exposed through disclosed draft content
Restrict access to /wp-json/ at the web application firewall until patching is confirmed

Patch Information

Upgrade the Create WordPress plugin to version 2.5.4 or later. The fixed version enforces authorization on the affected REST route. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Create WordPress plugin until the patched version is deployed
Block unauthenticated access to the plugin's REST namespace using a web application firewall rule
Restrict /wp-json/ endpoints to authenticated users at the reverse proxy layer where operationally feasible
Set restrictive file permissions on the plugin directory to prevent runtime modification

bash

# Example nginx rule to block unauthenticated access to the plugin REST namespace
location ~ ^/wp-json/create/ {
    if ($http_authorization = "") {
        return 403;
    }
}