CVE-2026-103293

Name of the Vulnerable Software and Affected Versions MPG WordPress plugin versions prior to 4.2.3

Description Insufficient validation of the dataset source during project import allows users with the Editor role and above to specify a local filesystem path instead of a remote URL. This leads to an arbitrary file read where the targeted file is copied into a publicly accessible uploads folder, making it retrievable by unauthenticated visitors.

Recommendations Update the MPG WordPress plugin to version 4.2.3 or later.