This vulnerability (CVE-2026-24552) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) in the Contributor feature of Create by Mediavine software. It affects versions up to and including 2.5.3. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, requiring low privileges but no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely to execute unauthorized SQL commands. This can lead to a compromise of confidential data and partial denial of service conditions. Integrity is not impacted according to the CVSS vector. The vulnerability affects the confidentiality and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable functionality to untrusted users where possible.