CVE-2023-33927: high-severity vulnerability in Themeisle Multiple Page Generator Plugin – MPG
WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.19 is vulnerable to SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The WordPress MPG plugin up to version 3.3.19 has a flaw that allows attackers to inject malicious SQL commands into the database. This can lead to unauthorized data access, modification, or deletion of website information.
The plugin fails to properly sanitize user input before constructing SQL queries, enabling unauthenticated or low-privileged attackers to inject arbitrary SQL commands. Exploitation typically requires the attacker to interact with vulnerable input fields exposed through the plugin's interface, potentially leading to information disclosure, data manipulation, or authentication bypass.
In the same product, most dangerous first.