Multiple Page Generator CVE-2026-85198

Three specific conditions must all be true simultaneously: (1) The attacker holds a WordPress account at subscriber level or above - if public registration is disabled and no credentials can be obtained, exploitation is blocked at the PR:L requirement. (2) The [mpg_spintax] shortcode is rendered in site-wide content such as a footer widget, global template part, or reusable block - if the shortcode is only placed on individual campaign pages, the vulnerable code path in HookController is not reached for arbitrary URL requests, and injection is not possible. (3) The site is running MPG plugin version 4.2.1 or earlier. Sites that deploy the plugin but do not use [mpg_spintax] in any site-wide context are not exploitable regardless of plugin version or user role availability.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) accurately characterizes a network-reachable, low-complexity exploit requiring a minimum-privilege authenticated session; the confidentiality-only impact (C:H/I:N/A:N) reflects that this is a read-path injection with no write or availability consequence. The most significant real-world limiting factor is the shortcode deployment condition: sites using the plugin but placing [mpg_spintax] only on isolated campaign pages are not exposed, which meaningfully reduces the exploitable population compared to what a raw CVSS score implies. That said, a plugin designed for site-wide programmatic SEO is frequently configured with shortcodes in footers or global templates - precisely the condition that activates the vulnerability - so the practical risk is higher than the deployment condition might suggest. No KEV listing or public exploit code exists at time of analysis, and EPSS data was not provided in the available intelligence. Even a mid-sized municipal IT team in swidnica running WordPress with this plugin for programmatic SEO campaigns should treat this as urgent if [mpg_spintax] appears in any site-wide component, since subscriber-level registration is commonly open to the public on content-heavy WordPress sites and a complete database dump represents a serious data-breach risk.

An attacker registers a free subscriber account on the target WordPress site, then requests any page where the [mpg_spintax] shortcode is rendered site-wide (e.g., the footer), crafting the URL path to include SQL injection payloads such as UNION SELECT clauses. The unsanitized path value is incorporated into the plugin's database query, returning data from arbitrary WordPress tables - including wp_users (login names and hashed passwords) and wp_options (API keys, secrets). No public exploit code has been identified at time of analysis, but the injection pattern is standard and well-documented in the WordPress security community.