The CVSS 6.5 score for this vulnerability significantly understates its actual risk profile. An unauthenticated attacker hitting a public REST endpoint in the Create plugin can retrieve unpublished draft content AND force its publication status to public simultaneously—two distinct security properties compromised in a single request with zero authentication required.
This is not merely an information disclosure flaw. The critical distinction is that the read operation itself triggers a state change: accessing draft content converts it to published status. What makes this particularly dangerous is the compounding blast radius. Once WordPress treats content as published, it immediately propagates to search engine indexers, RSS feeds, sitemap generation, and notification hooks before an administrator can react. The leaked draft doesn't stay leaked—it spreads across every downstream system that trusts published status as an access control boundary.
The vulnerability violates a foundational REST principle: GET requests must be idempotent and free of side effects. This endpoint treats content retrieval as a state-changing operation, which is an architectural failure, not merely a missing authorization check. Attackers can enumerate draft IDs systematically, harvesting entire editorial pipelines of sensitive content—embargoed announcements, business intelligence, pre-publication investigative work.
Prioritize this remediation regardless of the medium severity rating. The attack requires no authentication, no special privileges, and leaves no obvious forensic trail beyond the now-public content. Check your plugin version immediately: the affected Create plugin versions require updating. Review your site's search index and server logs for unexpected content appearance. The real risk isn't the initial read—it's the cascade of automated distribution that triggers the moment draft status flips to published.