{"id":"CVE-2026-104953","published":"2026-10-07T07:16:58.467","lastModified":"2026-10-07T14:52:43.420","description":"The MPG  WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e0b17720-b055-4d90-b0fa-68911274dafa/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}