CVE-2026-104953: MPG < 4.2.3 - Editor+ SQLi via Project Import
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Editor role or a higher-privileged role can exploit it. Unauthenticated visitors and lower-privileged users are not identified as able to exploit it.
What access or action is required for exploitation?
The attacker needs access to the plugin's project import functionality and must supply crafted imported project data. The injection occurs because the plugin does not properly validate the imported data structure before using it in a database query.
What could an attacker obtain?
The issue can be used to read sensitive data from the database, including password hashes. The provided CVSS vector indicates high confidentiality impact, with no stated integrity or availability impact.
Which versions need attention?
MPG: Mobile Pages Generator versions earlier than 4.2.3 are affected. Updating to version 4.2.3 or later addresses the affected version range described.