Security Alert Summary
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin is affected by a SQL injection vulnerability (CVE-2026-85198). Authenticated users with subscriber-level access or higher can abuse the plugin when the [mpg_spintax] shortcode is rendered in site-wide content, allowing additional SQL to be appended to existing queries and potentially exposing sensitive database information.
CVE Details
- CVE ID: CVE-2026-85198
- Affected component: MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin (vendor: themeisle)
- Affected versions: All versions up to and including 4.2.1
- Published: September 12, 2026 at 8:16:24 AM UTC
- Last modified: September 12, 2026 at 8:16:24 AM UTC
- CVSS v3.1: Base Score 6.5, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Authentication / privileges / user interaction: Requires authentication; low privileges required (subscriber-level or higher); no user interaction required
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
The vulnerability is a generic SQL injection via the URL path caused by insufficient escaping of a user-supplied parameter and lack of proper preparation on an existing SQL query. The vulnerable code path is only reached when the [mpg_spintax] shortcode is rendered in site-wide content (for example, in a footer or a template part). When that shortcode is active on the requested page, authenticated users with subscriber-level access or higher can append additional SQL statements to an existing query, which can be used to extract sensitive information from the database.
No REST endpoints or specific internal function names are provided in the description. The core issue is improper handling of input used in SQL queries and missing sufficient escaping/preparation, which enables injection through the URL path when the shortcode is processed.
How This Could Impact Your Website
Imagine a site where the site owner configures programmatic landing pages and an internal marketing editor regularly updates templates. An external contractor or contributor with subscriber-level access adds or previews content that triggers the [mpg_spintax] shortcode in a footer or template part. Because the shortcode processing can reach the vulnerable code path, a malicious but authenticated user could craft a request that appends SQL to the existing query and retrieve sensitive data such as user records or email addresses.
Practical consequences include exposure of internal user email addresses and other database-held information, which raises the risk of targeted phishing or social engineering aimed at staff, contractors, or contributors. The issue affects confidentiality rather than site integrity or availability based on the reported impact.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts that do not need access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit any shortcode usage in site-wide content (footers, template parts).
- Monitor site activity and database access logs for unusual behavior or unexpected queries.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/HookController.php#L594
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/controllers/SpintaxController.php#L66
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.1.7/helpers/Helper.php#L215
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/HookController.php#L594
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/controllers/SpintaxController.php#L66
- https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/4.2.0/helpers/Helper.php#L215
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3687328%40multiple-pages-generator-by-porthas&new=3687328%40multiple-pages-generator-by-porthas
- https://www.wordfence.com/threat-intel/vulnerabilities/id/677004db-d8ac-410c-89d9-ee841d643ef7?source=cve
