Mpg Multiple Page Generator Bulk Landing Pages Programmatic Seo
Monthly
SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.
SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.