Create WordPress plugin: Missing authorization check (broken access control)

Summary

The WordPress plugin Create (slug mediavine-create) up to and including version 3.1.1 has a missing authorization check, classified as broken access control. According to the CNA, an unauthenticated attacker over the network can reach functions they should not be allowed to use, which may expose limited data. The CVSS 3.1 score of 5.3 (Medium) reflects only low confidence impact, and the affected functions are not documented in the available sources.

Affected

• Create WordPress plugin (mediavine-create), versions 0 through 3.1.1

Fixed in

• Version 3.1.2 (unaffected according to the CVE record)

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild; no KEV entry.
• Third-party VulDB rates the exploit as easy and remote, requiring no authentication (estimate, not confirmed exploitation).
• No confirmed public proof of concept.

Our recommendation

• Check whether any WordPress site runs the Create plugin and which version.
• Update to version 3.1.2 or later; if this is not possible, deactivate and remove the plugin if it is not needed.
• Review web server logs for unusual requests to the plugin's endpoints.
• Verify the details against the Patchstack advisory once accessible.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-125046 www.cve.org
• Patchstack advisory patchstack.com
• VulDB entry 435815 vuldb.com
• Strix CVE-2026-125046 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:42.