Is CVE-2026-103293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103293 being exploited in the wild.

How severe is CVE-2026-103293?

Medium severity, with a CVSS score of 6.8, published 3 October 2026.

Which products and versions are affected?

Porthas Multiple Pages Generator (MPG) before 4.2.3.

Is there a fix for CVE-2026-103293?

Yes: fixed in 4.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103293 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103293?

Check whether you run Porthas Multiple Pages Generator (MPG) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103293: MPG WordPress plugin arbitrary file read via project import

CVE-2026-103293 · Severity: medium · CVSS 6.8 · Published 2026-10-03

The MPG WordPress plugin allows users with Editor role and above to read arbitrary files from the server. By importing a malicious project that specifies a local file path instead of a remote URL, an attacker can copy any file on the server into a publicly accessible folder, exposing sensitive data to unauthenticated visitors.

Vendors: Porthas.

Quick answers

Is CVE-2026-103293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103293 being exploited in the wild.
How severe is CVE-2026-103293?: Medium severity, with a CVSS score of 6.8, published 3 October 2026.
Which products and versions are affected?: Porthas Multiple Pages Generator (MPG) before 4.2.3.
Is there a fix for CVE-2026-103293?: Yes: fixed in 4.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103293 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103293?: Check whether you run Porthas Multiple Pages Generator (MPG) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.2.3

Technical details

The plugin fails to validate that the dataset source URL supplied during project import is actually remote before treating it as a local filesystem path. This allows authenticated users with Editor+ privileges to exploit path traversal (CWE-22) and retrieve arbitrary files via an unauthenticated download after the file is copied to the uploads directory. The vulnerability requires authentication and user interaction (project import action), but results in unauthorized information disclosure.

Affected products

Porthas Multiple Pages Generator (MPG) before 4.2.3

Timeline

2026-10-03: disclosed

References

https://wpscan.com/vulnerability/810447c9-4a8b-4d80-af7c-2f5fa8b13609/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.