SQL Injection Vulnerability in MPG WordPress Plugin by MPG
CVE-2026-104953
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-104953?
The MPG WordPress plugin versions prior to 4.2.3 contains a vulnerability that fails to adequately validate the structure of imported project data before utilizing it in database queries. This oversight allows users with Editor roles or higher permissions to execute SQL injection attacks. Consequently, malicious actors could exploit this flaw to gain unauthorized access to sensitive information, such as password hashes, thereby compromising user data integrity.
Affected Version(s)
MPG 0 < 4.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.