CVE-2026-18037

The CVE concerns the Create WordPress plugin (before 2.5.4). A public REST API route does not perform an authorization check, and renders content while also publishing it as a side effect, allowing unauthenticated disclosure of unpublished content and public publication of that content. Affected:...