Description

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-12T08:16:24.670Z",
  "pubdate": "2026-09-12T08:16:24.670Z",
  "executiveSummary": "The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is susceptible to a generic SQL injection vulnerability. This flaw arises from inadequate input validation and insufficient preparation of SQL queries involving user-supplied parameters. The vulnerability affects all versions up to, and including, 4.2.1.\nThe security impact is significant, as it allows authenticated attackers with subscriber-level privileges or higher to execute arbitrary SQL commands against the WordPress database. By injecting malicious payloads into the URL path, an attacker can manipulate existing database queries to extract sensitive information, potentially leading to unauthorized data disclosure or compromise of the database integrity.\nExploitation is contingent upon the [mpg_spintax] shortcode being present and rendered within site-wide content, such as footer sections or template parts, which triggers the vulnerable code execution path. Given that the vulnerability is exploitable by authenticated users with minimal privileges, the risk remains high for sites utilizing this programmatic SEO plugin. System administrators are advised to restrict access or update the plugin if a patch becomes available to mitigate this injection vector.",
  "technicalDetails": "The root cause of this SQL injection vulnerability lies in the improper handling of user-supplied input retrieved from the URL path. The plugin fails to apply adequate sanitization or escaping mechanisms to this input before integrating it into database queries. Furthermore, the underlying SQL query construction does not utilize prepared statements or parameterized queries, which are essential for preventing the injection of malicious SQL syntax.\nThe exploitation flow begins when a user initiates a request where the URL path contains crafted malicious input. For the vulnerability to be triggered, the target WordPress site must have the [mpg_spintax] shortcode rendered on the page, such as within the footer or common template files. When the shortcode is processed, the plugin executes the vulnerable code path that processes the URL parameters. Because these parameters are incorporated directly into the database query without sufficient escaping, an attacker can inject arbitrary SQL commands.\nAn attacker with subscriber-level access can supply a malicious string via the URL path to append additional queries or modify the logic of the existing query (e.g., using UNION-based injection). This behavior allows the attacker to manipulate the query structure, effectively bypassing intended data access controls. Once the payload is injected, the application processes the database query, returning results or altering the state of the database according to the injected command.\nThe post-exploitation impact allows for the unauthorized retrieval of database contents. This may include sensitive user information, configuration data, or other proprietary information stored in the WordPress database tables. Because the vulnerability requires the presence of a specific shortcode on the frontend, the attack surface is limited to pages where this shortcode is active. However, since the shortcode is often used globally for SEO purposes, the exposure is typically site-wide, allowing an attacker to target the most sensitive queries processed by the plugin across different landing pages.\nThe vulnerability affects all versions of the MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin up to, and including, version 4.2.1. Authentication is required, but the privilege threshold is low, as subscriber-level access is sufficient to initiate the attack vector."
}