CVE-2026-104953 — MPG < 4.2.3 - Editor+ SQLi via Project Import
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role…
Published: 2026-10-07 · CVSS: 6.8 · CVSS 3.1
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7