CVE-2026-104953

MediumCVSS 6.8

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The MPG WordPress plugin before version 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.

Risk Assessment

An attacker with editor privileges can access sensitive data, including user password hashes, potentially leading to account takeover and system integrity compromise.

Recommendation

Immediately update the MPG plugin to version 4.2.3 or later and restrict editor-level permissions to trusted users.

Other vulnerabilities in MPG WordPress plugin

CVE-2026-13726High
The MPG WordPress plugin before version 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response. Unauthenticated attackers can perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Original NVD description (English source)

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS