What is the CVSS score of CVE-2026-1233?

CVE-2026-1233 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1233?

The AI Voices by Mementor WordPress plugin (≤1.9.8) contains hardcoded database credentials in its telemetry functionality, allowing unauthenticated remote attackers to gain unauthorized write access…

How to fix or mitigate CVE-2026-1233?

Within 24 hours: Identify all WordPress installations running AI Voices by Mementor plugin and document current versions via admin dashboard or WP-CLI. Within 7 days: Immediately deactivate and remove all instances of the plugin (versions ≤1.9.8); if text-to-speech functionality is critical, evaluate alternative plugins without embedded credentials or contact vendor for security timeline on patched version 1.9.9 or later. Within 30 days: Conduct audit of vendor's telemetry server access logs for unauthorized modifications and implement network segmentation to restrict outbound connections to known vendor services.

WordPress CVE-2026-1233

EUVD-2026-18993 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-04-04 Wordfence

GHSA-6cvm-3hgq-v87x

WordPress Information Disclosure Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 04, 2026 - 11:30 euvd

EUVD-2026-18993

Analysis Generated

Apr 04, 2026 - 11:30 vuln.today

CVE Published

Apr 04, 2026 - 11:16 nvd

HIGH 7.5

DescriptionCVE.org

The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the Mementor_TTS_Remote_Telemetry class. This makes it possible for unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.

AnalysisAI

Hardcoded database credentials in Text to Speech for WP (AI Voices by Mementor) WordPress plugin versions ≤1.9.8 expose the vendor's external telemetry MySQL server to unauthorized write access by unauthenticated remote attackers. The credentials are embedded in the Mementor_TTS_Remote_Telemetry class and can be extracted via static analysis or HTTP request inspection. EPSS data not provided, but the unauthenticated network vector (CVSS:3.1/AV:N/AC:L/PR:N) and public disclosure via Wordfence ind

Technical ContextAI

This vulnerability stems from CWE-798 (Use of Hard-coded Credentials), a critical security anti-pattern where authentication secrets are embedded directly in source code. The affected component is the Mementor_TTS_Remote_Telemetry class within the Text to Speech for WP plugin (cpe:2.3:a:mvirik:text_to_speech_-_ttswp), which connects to an external vendor-operated MySQL telemetry database. Hardcoded credentials in WordPress plugins are particularly dangerous because plugin source code is publicly accessible in the WordPress repository, allowing trivial extraction through code inspection. The credentials provide write access to the telemetry database, though the CVSS vector indicates high confidentiality impact (C:H) with no integrity or availability impact scored, suggesting the primary risk may involve data exfiltration from the telemetry system rather than direct plugin compromise. The telemetry server's separation from WordPress installations means attackers gain access to vendor infrastructure rather than end-user sites, though compromised telemetry data could reveal usage patterns, site identities, or user behavior across all plugin installations.

RemediationAI

WordPress site administrators should immediately update the Text to Speech for WP plugin to the version released in or after WordPress plugin repository changeset 3453258, which removes the hardcoded database credentials from the Mementor_TTS_Remote_Telemetry class. Access the update through the WordPress admin dashboard under Plugins > Installed Plugins, or manually download the patched version from the official WordPress plugin repository. The specific fixed version number is not independently confirmed from available data, but the remediation commit is documented at https://plugins.trac.wordpress.org/changeset/3453258/text-to-speech-tts. If immediate patching is not feasible, site administrators should consider temporarily disabling the plugin until the update can be applied, particularly if concerns exist about vendor telemetry data exposure. Plugin developers and vendors should rotate the compromised MySQL database credentials immediately, audit telemetry database access logs for unauthorized activity, and implement secure credential management practices such as environment variables or encrypted configuration files. Additional guidance is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/b8dc0b5e-87b9-4831-a92a-bbf6eb1346e2?source=cve.