The MPG WordPress plugin prior to version 4.2.3 fails to validate the structure of data imported through its project import feature. This flaw allows a user with Editor privileges or higher to inject arbitrary SQL into a database query and read sensitive data such as password hashes. The vulnerability is an example of uncontrolled input leading to a data‑exposure attack. The impact is that any authenticated Editor can acquire confidential information that a proper authentication system should keep protected.

The affected product is the MPG WordPress plugin – versions earlier than 4.2.3. The vendor is not identified in the provided data. Any WordPress site that has an older MPG plugin deployed is vulnerable. Sites that use project import functionality and have users with Editor or higher roles are at risk.

The vulnerability can be exploited by submitting crafted project data through the import interface. An attacker must have Editor privileges or higher; no privileged escalation beyond that is required. The EPSS score is not available and the bug is not listed in the CISA KEV catalog, so the known likelihood of exploitation is uncertain. However, because the flaw allows reading password hashes, its severity remains high. The CVSS score is 6.8, indicating a moderate to high risk due to significant confidentiality impact. The attack vector is through an authenticated browser session using the import page. No additional impact beyond the user’s privileges is implied by the available data.