CVE-2026-85198: MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpgspintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. Unauthenticated visitors cannot exploit it based on the available information.
What site configuration is required for exploitation?
The [mpg_spintax] shortcode must be rendered in site-wide content, such as a footer or template part. The vulnerable code path is reached only when that shortcode is active on the page requested by the attacker.
What is the likely impact if exploitation succeeds?
An attacker may append SQL queries to an existing query and extract sensitive information from the WordPress database. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.
What can be done while a patch is unavailable?
Remove or disable [mpg_spintax] from site-wide content such as footers and template parts so the vulnerable code path is not reached. Restricting or removing low-privilege WordPress accounts also reduces exposure because exploitation requires Subscriber-level access or higher.