The Text to Speech for WP plugin contains hard‑coded MySQL credentials that allow an attacker to extract them and gain write access to the vendor’s telemetry database. The vulnerability is a clear instance of hard‑coded credential misuse (CWE‑798) and enables unauthorized database manipulation without authentication.

All WordPress sites running the Text to Speech – TTSWP plugin from Mervik with version 1.9.8 or earlier are affected. The flaw resides in the Mementor_TTS_Remote_Telemetry class and does not depend on any particular WordPress configuration beyond the plugin installation.

With a CVSS score of 7.5 the issue is considered high severity. No EPSS value is reported and the vulnerability is not listed in the CISA KEV catalog, suggesting limited documented exploitation. The attack vector is inferred to be remote and unauthenticated; anyone who can read the plugin code can retrieve the hard‑coded credentials and use them to write to the telemetry database. The damage potential is confined to the vendor’s telemetry system but could provide an attacker with a foothold for further activity through that database.