MPG WordPress Plugin EUVD-2026-91933

Requires an authenticated account with the Editor role or higher on the target WordPress site (per CVSS PR:H), and the MPG plugin must be installed and at a version before 4.2.3. The specific trigger is the project import workflow: the attacker supplies a local filesystem path where a remote dataset URL is expected, and the plugin does not validate the source is a remote URL before treating it as a local path and copying it into the public uploads folder. Limiting factors: the privileged-account requirement meaningfully narrows the attacker population (not remote-unauthenticated), there is no user interaction from a victim, and the second-stage retrieval of the copied file requires knowing or discovering its uploads URL.

This is a genuine but moderate-priority issue, best characterized as a high-privilege arbitrary file read rather than a wormable critical. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, 6.8) and the description agree: exploitation is network-reachable and low-complexity, but gated behind an Editor-or-above account (PR:H), which is the dominant limiting factor. The scope change (S:C) and C:H are justified because the read file is copied into a world-readable uploads folder, so the confidentiality impact crosses the authorization boundary and reaches unauthenticated visitors. Signals are consistent rather than conflicting: EPSS is low (0.16%, 5th percentile) and the CVE is NOT on CISA KEV, indicating no evidence of widespread or active exploitation, yet WPScan has published working exploit detail (POC=YES). The combination - low EPSS, no KEV, but public POC and a privileged prerequisite - points to a vulnerability that is realistically exploitable by a malicious or compromised privileged user but unlikely to see mass automated attacks. No data is missing for the core metrics; the main uncertainty is real-world install base of the plugin.

An attacker who already holds (or has phished/compromised) an Editor-level WordPress account imports a new MPG project and supplies a local filesystem path (e.g. wp-config.php or an OS secrets file) instead of a remote URL as the dataset source. The plugin fails to validate that the source is a remote URL, copies the targeted server file into the public uploads directory, and the attacker - or any unauthenticated visitor given the resulting URL - then downloads the sensitive contents. Public exploit detail is available from WPScan, lowering the skill needed to reproduce this.