Ieuns

**Name of the Vulnerable Software and Affected Versions** MPG WordPress plugin versions prior to 4.2.3 **Description** Insufficient validation of the dataset source during project import allows users with the Editor role and above to specify a local filesystem path instead of a remote URL. This leads to an arbitrary file read where the targeted file is copied into a publicly accessible uploads folder, making it retrievable by unauthenticated visitors. **Recommendations** Update the MPG WordPress plugin to version 4.2.3 or later.