CVE-2026-103293: MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

Q: Who can exploit this issue?

An authenticated WordPress user with the Editor role or higher can exploit it. The resulting copied file can then be retrieved by unauthenticated visitors if they know or can locate it in the public uploads folder.

Q: What access or conditions does an attacker need?

The attacker needs an account with Editor-level privileges or above and access to the MPG project import functionality. They must be able to supply a dataset source that is treated as a local filesystem path.

Q: Are files exposed directly from the server?

Yes. The vulnerable import behavior copies the selected local file into a publicly accessible uploads folder, where it can be downloaded without authentication.

Q: Which versions are affected?

MPG versions before 4.2.3 are affected.

Published Oct 3, 2026

Updated

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.

Affected Software

1 affected component

MPG MPG WordPress plugin<4.2.3

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with the Editor role or higher can exploit it. The resulting copied file can then be retrieved by unauthenticated visitors if they know or can locate it in the public uploads folder.

What access or conditions does an attacker need?

The attacker needs an account with Editor-level privileges or above and access to the MPG project import functionality. They must be able to supply a dataset source that is treated as a local filesystem path.

Are files exposed directly from the server?

Yes. The vulnerable import behavior copies the selected local file into a publicly accessible uploads folder, where it can be downloaded without authentication.

Which versions are affected?

MPG versions before 4.2.3 are affected.

CVE-2026-103293: MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or conditions does an attacker need?

Are files exposed directly from the server?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or conditions does an attacker need?

Are files exposed directly from the server?

Which versions are affected?