CVE-2026-103293

MediumCVSS 6.8/10Last modified Oct 6, 2026

Description

The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1032945.9CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An a CVE-2026-1032967.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security fea CVE-2026-1032977.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security fea CVE-2026-1033015.3The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because th CVE-2026-1033025.3The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the CVE-2026-1033045.3The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJA CVE-2026-1033058.8The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape so CVE-2026-1033078.6The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it CVE-2026-1033086.5The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on CVE-2026-1033097.5The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when output CVE-2026-1033115.3The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment we CVE-2026-1033147.4A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain u