The Multiple Pages Generator (MPG) WordPress plugin, developed by Themeisle, contains an unauthenticated sensitive data exposure flaw affecting versions up to 4.2.3. In its current form, the plugin allows an unauthenticated user to retrieve portions of data that should be restricted, potentially exposing database contents, configuration details, or other confidential information. The vulnerability is rooted in a lack of proper access controls, as indicated by the associated CWE-201 identifier. The absence of authentication checks means that any internet‑connected user could craft a request to the plugin’s endpoints and receive privileged data without logging in. This impact poses a risk to confidentiality for all WordPress sites running an affected instance of the MPG plugin.

WordPress sites that have installed the Themeisle "Multiple Pages Generator" plugin at or below version 4.2.3. The vendor is Themeisle and the product is the WordPress plugin referred to as MPG.

The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score is not available, implying that exploitation likelihood is uncertain but non‑zero. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploitation, but because the flaw allows unauthenticated access to sensitive data, attackers could leverage it to compromise site confidentiality. The likely attack vector is through crafted HTTP requests to the plugin’s endpoints, exploiting the plugin’s failure to enforce authentication. Although no exploit has been documented, the flaw presents a straightforward path for attackers to gather sensitive information from vulnerable WordPress installations.