CVE-2026-18037 describes a missing authorization check in the Create WordPress plugin prior to version 2.5.4. Specifically, one of the plugin's public REST API routes renders content without verifying the requester's permissions. Additionally, this route publishes the requested content as a side effect, enabling unauthenticated attackers to access and publicly expose unpublished content. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Unauthenticated attackers can read unpublished content and cause it to be published publicly, leading to unauthorized disclosure and modification of content. There is no indication of availability impact. This could result in sensitive or private content being exposed without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 2.5.4, upgrading to version 2.5.4 or later is likely recommended once confirmed by the vendor. Until then, restrict access to the affected REST API route if possible or disable the plugin if the risk is unacceptable.