CVE-2026-18037 Overview
CVE-2026-18037 is a missing authorization vulnerability [CWE-862] in the Create WordPress plugin versions prior to 2.5.4. The plugin exposes a public REST API route that renders content without performing an authorization check. The same route publishes the requested content as a side effect of the request. Unauthenticated attackers can read unpublished posts and force their publication over the network. The issue affects confidentiality and integrity of draft and private content managed by the plugin.
Critical Impact
Remote, unauthenticated attackers can disclose unpublished WordPress content and cause it to become publicly visible without any user interaction.
Affected Products
- Create WordPress plugin versions before 2.5.4
- WordPress sites with the Create plugin enabled and REST API reachable
- Any hosting environment exposing the plugin's public REST route to the internet
Discovery Timeline
- 2026-08-09 - CVE-2026-18037 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-18037
Vulnerability Analysis
The Create WordPress plugin registers a REST API route intended to render content. The route does not verify whether the requesting user has permission to view the requested resource. As a side effect of rendering, the route transitions the target content to a published state. This combines a read authorization flaw with an unintended write action in a single request.
Because the route is public, an attacker only needs network access to the WordPress REST API endpoint. No authentication, no user interaction, and no elevated privileges are required. Attackers can iterate over post identifiers to enumerate draft, pending, or private content and publish it in the process.
Root Cause
The root cause is a missing permission_callback (or equivalent capability check) on the REST route registration. WordPress REST routes require an explicit authorization callback that validates the caller's capabilities against the requested object. The affected plugin route omits this check and relies on the route being reachable as an implicit trust boundary. The publication side effect compounds the flaw by mutating state during what should be a read operation.
Attack Vector
Exploitation requires only an HTTP request to the vulnerable REST API endpoint. An attacker crafts a request referencing the identifier of an unpublished post managed by the plugin. The server returns the rendered content in the response and marks the post as published. The attacker then repeats the process across identifiers to harvest and disclose additional unpublished content. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-18037
Indicators of Compromise
- Unauthenticated HTTP requests to /wp-json/ routes registered by the Create plugin from unfamiliar source addresses
- Unexpected publish status transitions on posts that were previously in draft, pending, or private state
- Web server access logs showing sequential enumeration of post identifiers against the plugin's REST route
- Audit log entries showing content publication without a corresponding authenticated user session
Detection Strategies
- Alert on WordPress REST API requests to plugin routes that originate outside authenticated administrative sessions
- Correlate post_status changes in the WordPress database with authentication events to flag unauthenticated publications
- Monitor for high request rates against /wp-json/ endpoints that reference incrementing post IDs
Monitoring Recommendations
- Enable WordPress audit logging plugins to record REST API access and post status transitions
- Forward web server and WordPress logs to a centralized analytics platform for retention and correlation
- Baseline normal REST API traffic patterns to surface anomalous unauthenticated access to plugin routes
How to Mitigate CVE-2026-18037
Immediate Actions Required
- Update the Create WordPress plugin to version 2.5.4 or later on all affected sites
- Review published content for posts that transitioned from draft or private status without administrator action, and revert as needed
- Restrict access to the WordPress REST API at the web server or WAF layer until patching is complete
Patch Information
Upgrade the Create plugin to version 2.5.4, which adds the missing authorization check on the affected REST API route. Verify the plugin version through the WordPress admin dashboard under Plugins after applying the update. Consult the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Create plugin until the 2.5.4 update can be applied
- Block unauthenticated access to the plugin's REST route with a Web Application Firewall rule
- Restrict /wp-json/ access to authenticated sessions at the reverse proxy where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
