CVE-2026-97302

MediumCVSS 5.3

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The MPG plugin in versions up to and including 4.2.3 allows an unauthenticated user to access sensitive data. The lack of required authentication enables exposure of confidential information.

Risk Assessment

An unauthorized person may gain access to data that should be protected, potentially leading to information leakage and a confidentiality breach.

Recommendation

Update the MPG plugin to a version later than 4.2.3 that fixes the vulnerability, or temporarily restrict access to it.

Other vulnerabilities in MPG

CVE-2026-103293Medium
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.

Original NVD description (English source)

Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS