Missing Authorization Vulnerability in Mediavine Create Plugin
CVE-2026-125046

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Create
Vendor
CVE Published:
11 November 2026

What is CVE-2026-125046?

A missing authorization vulnerability exists in the Mediavine Create plugin developed by John-Michael L'Allier. This issue arises from incorrectly configured access control security settings, which could allow unauthorized users to exploit certain functionalities within the plugin. The vulnerability affects the Mediavine Create plugin from versions n/a through 3.1.1, potentially leading to unauthorized access and manipulation of features that should be restricted.

Affected Version(s)

Create 0 <= 3.1.1

References

https://patchstack.com/database/wordpress/plugin/mediavin...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Malvin Valerian Gultom | Patchstack Bug Bounty Program
.