Remote File Inclusion in MPG WordPress Plugin by MPG
CVE-2026-103293
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-103293?
The MPG WordPress plugin, in versions before 4.2.3, contains a vulnerability where it fails to validate the source of a dataset provided during the import process. Specifically, it allows users with Editor roles and above to manipulate file imports, treating remote URLs as local file paths. This flaw enables the copying of sensitive files into a publicly accessible uploads directory, potentially exposing arbitrary server files to unauthenticated users who can access the uploads folder.
Affected Version(s)
MPG 0 < 4.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.