CVE-2026-85198 Overview
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress contains a SQL Injection vulnerability via the URL path. The flaw affects all versions up to and including 4.2.1. Authenticated attackers with subscriber-level access or above can append additional SQL queries to existing statements. Successful exploitation allows extraction of sensitive information from the WordPress database. The vulnerability is only reachable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part. The issue is tracked under CWE-89.
Critical Impact
Authenticated subscribers can extract sensitive database contents through SQL injection on sites where the [mpg_spintax] shortcode is active in global template regions.
Affected Products
- MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO (WordPress plugin) versions ≤ 4.2.1
- Deployments that render the [mpg_spintax] shortcode in site-wide content (footers, headers, template parts)
- WordPress sites permitting subscriber-level registration
Discovery Timeline
- 2026-09-12 - CVE-2026-85198 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-85198
Vulnerability Analysis
The vulnerability resides in the plugin's spintax rendering path, which processes the request URL when the [mpg_spintax] shortcode is active on the requested page. User-supplied data drawn from the URL path flows into a database query without adequate escaping or parameter binding. Because the query is neither properly escaped nor prepared, an attacker can inject additional SQL fragments that the database executes as part of the original statement. The vulnerable path is documented in the plugin's HookController.php, SpintaxController.php, and Helper.php source files.
Root Cause
The root cause is insufficient escaping of user-supplied input combined with the absence of prepared statements around the affected SQL query. The plugin concatenates values derived from the request into the query string rather than binding them as parameters. This pattern falls under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Attack Vector
Exploitation requires an authenticated account with subscriber-level privileges or higher. The attacker requests a page that renders [mpg_spintax] in a site-wide region, embedding SQL payloads within the URL path. The plugin passes that path into the vulnerable query, allowing the appended SQL to execute against the WordPress database. The impact is limited to confidentiality; integrity and availability are not directly affected. See the Wordfence Threat Intelligence Report and the plugin source in SpintaxController.php and Helper.php for the affected code paths. No public proof-of-concept code has been released.
Detection Methods for CVE-2026-85198
Indicators of Compromise
- Web access log entries containing SQL syntax such as UNION SELECT, SLEEP(, --, information_schema, or encoded equivalents inside URL path segments targeting pages that render [mpg_spintax].
- Requests originating from newly created subscriber accounts followed by database errors in PHP or WordPress debug logs.
- Unexpected reads against sensitive tables such as wp_users or wp_usermeta in database query logs.
Detection Strategies
- Audit the site for use of the [mpg_spintax] shortcode in footers, headers, sidebars, and template parts; sites without this configuration are not reachable.
- Deploy or update a WordPress-aware web application firewall with rules covering SQL injection patterns in URL path segments.
- Correlate authentication events for subscriber accounts with subsequent anomalous URL requests using centralized log analytics.
Monitoring Recommendations
- Enable WordPress and database query logging on hosts running the MPG plugin and forward events to a SIEM.
- Alert on repeated 500-series responses and MySQL syntax errors tied to a single authenticated session.
- Monitor for unexpected creation of subscriber accounts, particularly from automated registration flows.
How to Mitigate CVE-2026-85198
Immediate Actions Required
- Update the MPG – Multiple Page Generator plugin to a version later than 4.2.1 that contains the vendor fix.
- Temporarily remove the [mpg_spintax] shortcode from site-wide content until the update is applied.
- Review and disable open user registration where subscriber-level accounts are not required.
- Rotate secrets and review the wp_users table for signs of information disclosure.
Patch Information
The vendor addressed the issue in a subsequent release; the corresponding source modification is documented in the WordPress Plugin Change Set. Administrators should apply the update through the WordPress plugins dashboard or via WP-CLI.
Workarounds
- Remove the [mpg_spintax] shortcode from all site-wide template locations to eliminate the vulnerable code path.
- Restrict new user registrations, or gate the subscriber role behind additional verification, to reduce the pool of authenticated attackers.
- Deploy WAF rules that block SQL metacharacters in URL path segments handled by the plugin.
# Update the plugin using WP-CLI
wp plugin update multiple-pages-generator-by-porthas
# Verify installed version
wp plugin get multiple-pages-generator-by-porthas --field=version
# Disable open registration as a defense-in-depth measure
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
