medium6.8
CVE-2026-104953
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users wit…
Impact
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Affected products
| Product | Affected versions |
|---|---|
| MPG WordPress Plugin | before 4.2.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.