EUVD-2026-89936
GHSA-rhqp-xxqr-xp89
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable MPG plugin
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionPlugin returns sensitive data in response
-
ImpactHarvest disclosed information for further targeting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Multiple Pages Generator (MPG) WordPress plugin at versions <= 4.2.3, per PR:N/UI:N/AC:L. The only prerequisites are network reachability of the WordPress site and the vulnerable plugin being installed and active. Impact is inherently limited to partial confidentiality disclosure (C:L), so the practical risk is bounded by whatever specific data element the plugin leaks, which the advisory does not enumerate. |
| Impact | All CVSS signals point to an easily reachable but low-impact issue: AV:N/AC:L/PR:N/UI:N means an unauthenticated remote attacker can trigger it against a default install with no user interaction, yet the impact is confined to C:L (limited confidentiality disclosure) with I:N/A:N - no integrity or availability effect - yielding a modest 5.3 base score consistent with CWE-201 (information exposure through sent data). There is no EPSS score, no CISA KEV listing, and no public POC provided in the intelligence, so exploitation status is unproven; the 5.3/C:L rating indicates this leaks partial/limited data rather than full credentials or database contents. This is a real-but-low-priority issue: trivial to exploit and pre-authentication (which raises opportunistic risk for internet-facing WordPress sites), but the bounded confidentiality-only impact keeps it well below the threshold that warrants emergency patching. No signals conflict; the main missing data is the specific data element exposed, which the sparse Patchstack description does not name. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running Multiple Pages Generator (MPG) 4.2.3 or earlier and receives back sensitive information the plugin should not disclose (e.g. configuration details, source dataset paths, or internal metadata). No credentials, user interaction, or special configuration are required. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated sensitive data exposure in the Multiple Pages Generator (MPG) WordPress plugin from Themeisle, affecting versions 4.2.3 and earlier, allows any remote visitor to read information the plugin includes in its HTTP responses without authenticating or interacting with the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3). The consequence is confined to partial confidentiality loss - no integrity or availability impact - making it an information-gathering aid that could support follow-on attacks rather than a direct compromise vector. No public exploit code has been identified at time of analysis, and the flaw has not been confirmed as actively exploited (CISA KEV).
RemediationAI
No vendor-released patch was identified in the provided data: the advisory lists 4.2.3 as the affected upper bound but supplies no fixed version, so there is no upgrade target to cite. Until Themeisle publishes a corrected release, the most reliable action is to deactivate and, if the functionality can be replaced, remove the Multiple Pages Generator plugin entirely - the trade-off is loss of the plugin's multi-page template generation feature. If the plugin must remain active, apply a compensating control at the edge: use a web application firewall or reverse-proxy rule to block or virtual-patch requests that reach the leaking endpoint, recognizing that the exact route is not enumerated in the available data and must first be identified by comparing the plugin's public facing hooks. Because exploitation requires only network reachability and no authentication (PR:N/UI:N), limiting access is difficult without also restricting legitimate visitors, so log review is a useful secondary measure - examine web server and WordPress access logs for repeated or scripted requests to admin-ajax.php actions and REST routes registered by the plugin. Monitor the Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/multiple-pages-generator-by-porthas/vulnerability/wordpress-mpg-plugin-4-2-3-sensitive-data-exposure-vulnerability?_s_id=cve) for a patched version, and treat any credentials, API keys, or template content confirmed as exposed as requiring rotation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness class is CWE-201, Information Exposure Through Sent Data, meaning the application transmits data to a recipient (here, an unauthenticated HTTP client) that contains more information than the recipient should be permitted to receive. In WordPress plugin terms this typically surfaces as a publicly reachable endpoint - an admin-ajax.php action registered with the nopriv hook, a REST API route with a permissive permission_callback, or shortcode/template output - that returns internal configuration, template definitions, or user-related fields to any requester. The CPE cpe:2.3:a:themeisle:mpg:*:*:*:*:*:*:*:* maps the affected component to the Themeisle 'mpg' package with an unconstrained version wildcard, matching the advisory's '<= 4.2.3' boundary, so every release up to and including 4.2.3 is presumed vulnerable. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), which means the leak can be triggered programmatically by a simple request; the scoring scope is unchanged (S:U) and the impact sub-score is deliberately limited to C:L because the advisory does not enumerate what specific data element is disclosed. The plugin's core purpose - generating multiple pages from reusable templates - implies the plugin holds structured template and page-configuration data, which is the kind of content that ends up in a leaked response.
Know when Mpg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote request over the network with no interaction (AV:N/AC:L/PR:N/UI:N) yields limited confidentiality disclosure only (C:L), matching CWE-201 sensitive data exposure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scr
SQL injection in the MPG WordPress plugin before 4.2.3 allows authenticated users holding the Editor role or higher to i
Authenticated arbitrary file read in the MPG WordPress plugin (versions before 4.2.3) allows a user holding the Editor r
Exploit-DB