{"id":"CVE-2026-125046","kind":"vulnerability","aliases":["CVE-2026-125046"],"related":[],"title":"Create mediavine-create WordPress plugin: missing authorization check, versions through 3.1.1","description":"Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1.","summary":"The mediavine-create plugin by John-Michael L'Allier has a missing authorization check, so access control is not enforced on some actions. The sources do not state what an attacker can read or change once they reach that action.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediavine-create","package","wordpress"],"not_affected_if":[],"how_to_check":"- Look for the `mediavine-create` plugin in the WordPress plugins list and note its version\n- Treat versions `3.1.1` and earlier as affected, per the source range","fix":null,"status":"open","published_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:38+00:00","updated_at":"2026-11-11T13:29:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T13:29:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Create mediavine-create WordPress plugin: missing authorization check, versions through 3.1.1","impact":"medium","summary":"The mediavine-create plugin by John-Michael L'Allier has a missing authorization check, so access control is not enforced on some actions. The sources do not state what an attacker can read or change once they reach that action.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mediavine-create"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access-control bypass on affected WordPress sites","analyst_note":"Confirm which plugin action lacks the capability check and the fixed version, using the vendor's changelog or the Wordfence/NVD entry for CVE-2026-125046.}","how_to_check":"- Look for the `mediavine-create` plugin in the WordPress plugins list and note its version\n- Treat versions `3.1.1` and earlier as affected, per the source range\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the mediavine-create WordPress plugin at version 3.1.1 or earlier are in scope, according to the affected range given. The sources do not say which role or setting is needed to reach the unauthorized action, so whether a site without special setup is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4538,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125046':15A,18A '-2026':14A,17A '3.1.1':12A,93C 'access':41B,83C 'action':48B,65B 'affect':88C 'allier':34B,74C 'allow':79C 'attack':56B 'author':8A,38B,67C 'chang':60B 'check':9A,39B 'configur':82C 'control':42B,84C 'creat':1A,4A,21B,27B,75C,78C,89C 'cve':13A,16A 'enforc':45B 'exploit':80C 'incorrect':81C 'issu':87C 'john':31B,71C 'john-michael':30B,70C 'l':33B,73C 'levels.this':86C 'mediavin':3A,20B,26B,77C 'mediavine-cr':2A,19B,25B,76C 'michael':32B,72C 'miss':7A,37B,66C 'n/a':91C 'packag':22B 'plugin':6A,28B 'reach':63B 'read':58B 'secur':85C 'sourc':50B 'state':53B 'version':10A 'vulner':68C 'wordpress':5A,23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the mediavine-create WordPress plugin at version 3.1.1 or earlier are in scope, according to the affected range given. The sources do not say which role or setting is needed to reach the unauthorized action, so whether a site without special setup is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mediavinecreate","medium","package","wordpress"],"campaign_type":null,"search_a":"'-125046':15A,18A '-2026':14A,17A '3.1.1':12A 'author':8A 'check':9A 'creat':1A,4A 'cve':13A,16A 'mediavin':3A 'mediavine-cr':2A 'miss':7A 'plugin':6A 'version':10A 'wordpress':5A","search_b":"'access':41B 'action':48B,65B 'allier':34B 'attack':56B 'author':38B 'chang':60B 'check':39B 'control':42B 'creat':21B,27B 'enforc':45B 'john':31B 'john-michael':30B 'l':33B 'mediavin':20B,26B 'mediavine-cr':19B,25B 'michael':32B 'miss':37B 'packag':22B 'plugin':28B 'reach':63B 'read':58B 'sourc':50B 'state':53B 'wordpress':23B","search_c":"'3.1.1':93C 'access':83C 'affect':88C 'allier':74C 'allow':79C 'author':67C 'configur':82C 'control':84C 'creat':75C,78C,89C 'exploit':80C 'incorrect':81C 'issu':87C 'john':71C 'john-michael':70C 'l':73C 'levels.this':86C 'mediavin':77C 'mediavine-cr':76C 'michael':72C 'miss':66C 'n/a':91C 'secur':85C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125046","severity":null,"published_at":"2026-11-11T13:17:20+00:00","modified_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}