MPG WordPress Plugin EUVD-2026-94184

Exploitation requires an authenticated WordPress account with the Editor role or higher (PR:H) and access to the MPG plugin's project-import functionality; the attacker must submit crafted project data whose structure the plugin fails to validate before building a database query. The limiting factor is the trust level: a standard Subscriber, Contributor, or anonymous visitor cannot exploit this - only users already granted Editor-or-above capabilities. It affects MPG versions before 4.2.3; upgrading to 4.2.3 removes the condition. No special non-default configuration is indicated beyond the plugin being installed and the import feature being reachable by the privileged user.

This is a moderate-priority, authenticated SQL injection (CWE-89) in the MPG WordPress plugin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8) is internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring high privileges (PR:H), which aligns with the stated prerequisite of an Editor role or higher. Impact is confidentiality-only (C:H, I:N, A:N), matching the description's claim that the flaw reads sensitive data such as password hashes rather than modifying or destroying it. Signals are not fully aligned: a public exploit exists (POC=YES, reported by WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The PR:H requirement is the dominant risk limiter - an attacker must already hold a trusted, authenticated Editor-level account, which substantially narrows the realistic threat to insider abuse or post-compromise privilege escalation rather than mass opportunistic attack. Net assessment: a real but second-tier issue; the public POC warrants prompt patching, but the authentication barrier makes it unsuitable for untargeted mass exploitation. EPSS is missing and should be checked before final prioritization.

An attacker who has obtained an Editor-level (or higher) WordPress account - for example a lower-trust content contributor or a compromised staff login - crafts a malicious MPG project import payload whose structure is not properly validated before being used in a database query. Submitting this import triggers SQL injection, letting the attacker extract arbitrary database contents including administrator password hashes. A public exploit for this vulnerability is available via WPScan, lowering the effort required to reproduce the attack.