CVE-2026-104953
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project…
- Risk score
- 43/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
- Affected
- See advisory
- Fix
- Upgrade the product to 4.2.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Last activity 7 Oct 2026. Patch Forecast updates every hour.