CVE-2026-85198

Name of the Vulnerable Software and Affected Versions MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO versions prior to 4.2.2

Description This issue is a generic SQL Injection via URL Path caused by insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the existing SQL query. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database. This is only exploitable when the [mpg spintax] shortcode is rendered in site-wide content, such as a footer or template part, because the vulnerable code path is only accessed when the shortcode is active on the requested page.

Recommendations Update to a version newer than 4.2.1. As a temporary mitigation, avoid rendering the [mpg spintax] shortcode in site-wide content like footers or template parts.