CVE-2026-1233

HighCVSS 7.5/10Last modified Jul 21, 2026

Description

The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TTS_Remote_Telemetry` class. This makes it possible for unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
mvirikText to Speech – TTSWP<= 1.9.8

References

Timeline

Published
Apr 4, 2026
Last modified
Jul 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-123305.4Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37,CVE-2026-1233002.7In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappingsCVE-2026-1233018.2In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possibleCVE-2026-1233027.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script eCVE-2026-1233047.8In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathCVE-2026-1233057.5In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote hostCVE-2026-1233067.4In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsCVE-2026-1233076.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possibleCVE-2026-1233086.3In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projectsCVE-2026-1233096.1In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown previewCVE-2026-1233105.4In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projectsCVE-2026-1233115.3In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
CVE-2026-1233: High severity, CVSS 7.5 | Vulnix