CVE-2026-103293: MPG WordPress Plugin Path Traversal Flaw

CVE-2026-103293 Overview

CVE-2026-103293 is a path traversal vulnerability in the MPG WordPress plugin before version 4.2.3. The plugin fails to validate that the dataset source supplied during project import is a remote URL. Instead, it treats the input as a local filesystem path and copies the referenced file into a publicly accessible uploads folder. Authenticated users with the Editor role or higher can read arbitrary files on the server. The copied files are then retrievable by unauthenticated visitors who know the resulting URL. This creates a two-stage information disclosure chain combining authenticated file read with unauthenticated retrieval.

Critical Impact
Editor-level users can exfiltrate sensitive server files including wp-config.php, exposing database credentials and WordPress authentication secrets to unauthenticated remote attackers.

Affected Products

MPG WordPress plugin versions prior to 4.2.3
WordPress sites running the vulnerable plugin with Editor or higher accounts
Publicly accessible WordPress installations exposing the uploads directory

Discovery Timeline

2026-10-03 - CVE-2026-103293 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103293

Vulnerability Analysis

The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The MPG plugin exposes a project import feature that accepts a dataset source parameter. The intended use case is to fetch a remote dataset from a URL. The plugin logic does not verify that the supplied value uses a network scheme such as http:// or https://. When a local filesystem path is submitted, the plugin reads the file from disk and copies it into the WordPress uploads directory.

The uploads directory is served directly by the web server without authentication. Any file written there becomes retrievable through a predictable URL. This design decision converts a plugin feature into a server-wide arbitrary file read primitive. The attacker needs Editor privileges to trigger the import but requires no authentication to retrieve the copied artifact.

Root Cause

The root cause is missing input validation on the dataset source parameter. The plugin should reject any value that does not match a remote URL scheme. Instead it accepts absolute paths such as /var/www/html/wp-config.php or /etc/passwd and treats them as valid sources. The copy operation runs with the privileges of the web server process, granting access to any file readable by that user.

Attack Vector

An attacker first obtains or compromises an account with Editor role or higher. They then invoke the project import function and supply a local filesystem path as the dataset source. The plugin copies the target file into the uploads directory under a path derived from the project. The attacker, or any unauthenticated visitor, then requests the file directly from the uploads URL to retrieve its contents. Primary targets include wp-config.php for database credentials and authentication keys, private SSH keys, environment files, and application source code.

See the WPScan Vulnerability Details for additional technical references.

Detection Methods for CVE-2026-103293

Indicators of Compromise

Unexpected files appearing in the WordPress uploads directory with names or extensions inconsistent with media content, such as .php, .conf, or extensionless system files
Access log entries from Editor accounts invoking MPG project import endpoints with non-URL dataset source parameters
Unauthenticated GET requests to uploads paths containing filenames like wp-config, passwd, or shadow
Outbound requests originating from MPG import handlers that reference local file paths rather than remote hosts

Detection Strategies

Review WordPress audit logs for MPG import actions and correlate the submitted dataset source values against a remote URL allowlist
Scan the uploads directory for files containing PHP tags, database credentials, or private key headers
Alert on HTTP responses from /wp-content/uploads/ paths returning content types or signatures associated with configuration files

Monitoring Recommendations

Enable WordPress action logging for all Editor and Administrator role activity involving plugin import functions
Deploy file integrity monitoring on wp-content/uploads/ to detect writes of non-media file types
Forward web server access logs to a centralized analytics platform and build detections for suspicious uploads directory reads

How to Mitigate CVE-2026-103293

Immediate Actions Required

Update the MPG plugin to version 4.2.3 or later on all WordPress installations
Audit all Editor and higher accounts for unexpected activity and rotate credentials where compromise is suspected
Rotate WordPress authentication keys, salts, and database credentials if wp-config.php may have been exposed
Inspect the uploads directory for files copied from sensitive filesystem locations and remove them

Patch Information

The vendor fixed this issue in MPG plugin version 4.2.3. The patched release validates that the dataset source is a remote URL before processing. Site administrators should apply the update through the WordPress plugin manager or by replacing the plugin files directly. Refer to the WPScan Vulnerability Details for release information.

Workarounds

Deactivate the MPG plugin until the update to 4.2.3 or later is applied
Restrict the Editor role from accessing MPG import functionality through a capability management plugin
Configure the web server to deny direct access to non-media file extensions within wp-content/uploads/
Enforce multi-factor authentication on all Editor and Administrator accounts to reduce the risk of account compromise

bash

# Example nginx rule to block non-media file retrieval from uploads
location ~* ^/wp-content/uploads/.*\.(php|phtml|conf|env|key|pem|ini|log|sh|sql)$ {
    deny all;
    return 403;
}