Executive brief
The Text to Speech for WP plugin for WordPress, which adds AI-generated voice capabilities to websites, contains hardcoded login credentials for the developer's own data collection server. An attacker can find these credentials within the plugin's publicly available code and use them to access the developer's external database. While this primarily impacts the vendor's own infrastructure, it represents a significant security oversight that could lead to the exposure of telemetry data collected from websites using the plugin.
Technical details
The vulnerability is classified as a Use of Hard-coded Credentials (CWE-798) within the `Mementor_TTS_Remote_Telemetry` class of the Text to Speech for WP plugin. All versions up to and including 1.9.8 contain plaintext or easily decodable MySQL database credentials intended for the vendor's external telemetry server. An unauthenticated remote attacker can extract these credentials by inspecting the plugin source code. Once obtained, these credentials grant unauthorized write access to the vendor's remote telemetry database. A fix was introduced in changeset 3453258.
Affected products
- Mementor Text to Speech for WP (AI Voices by Mementor) up to, and including, 1.9.8
Timeline
- 2026-04-04: advisory: Initial disclosure by Wordfence
- 2026-04-04: disclosed: CVE-2026-1233 published