WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.19 is vulnerable to SQL Injection

The WordPress MPG plugin up to version 3.3.19 has a flaw that allows attackers to inject malicious SQL commands into the database. This can lead to unauthorized data access, modification, or deletion of website information.

The plugin fails to properly sanitize user input before constructing SQL queries, enabling unauthenticated or low-privileged attackers to inject arbitrary SQL commands. Exploitation typically requires the attacker to interact with vulnerable input fields exposed through the plugin's interface, potentially leading to information disclosure, data manipulation, or authentication bypass.