CVE-2026-13200 describes a SQL Injection vulnerability in the Create plugin for WordPress by mischiefmarmot. The flaw exists in all versions up to and including 2.5.3, where the 'order' parameter is not properly sanitized before being incorporated into SQL queries. The vulnerable code path is triggered when at least one of the following parameters is included in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type. Authenticated attackers with author-level privileges or higher can append arbitrary SQL commands to extract sensitive data from the database. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with author-level or higher privileges can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. No known exploits are reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict author-level access to trusted users only and consider disabling or limiting use of the affected parameters in requests if possible.