Skip to content
Sign in
6.8 Medium

CVE-2026-104953 The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it…

Description

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.

Affected products and versions

Product Affected versions Fixed in
MPG 4.2 earliest → < 4.2.3 4.2.3

Other CVEs of MPG

The 3 CVEs of MPG →
CVE-2026-103293 The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is… 6.8 Medium CVE-2026-13726 The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the… 7.1 High
Track this CVE