CVE-2026-125046 · Package
NO FIX YET
The mediavine-create plugin by John-Michael L'Allier has a missing authorization check, so access control is not enforced on some actions. The sources do not state what an attacker can read or change once they reach that action.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the mediavine-create WordPress plugin at version 3.1.1 or earlier are in scope, according to the affected range given. The sources do not say which role or setting is needed to reach the unauthorized action, so whether a site without special setup is exposed is unknown.
Who cares mediavine-create, wordpress
mediavine-create plugin in the WordPress plugins list and note its version3.1.1 and earlier as affected, per the source rangeNo fix yet, per the sources.
Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.