CVE-2026-97302 Themeisle CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations using the MPG plugin should assess their exposure and potential data exposure risk.

Why it matters

CVE-2026-97302 is a medium-severity vulnerability in the MPG plugin that could allow unauthenticated sensitive data exposure. Administrators and security teams responsible for WordPress installations using the MPG plugin should verify their exposure and assess potential data exposure risk.

• Verify potential exposure of sensitive data in your environment.
• Assess the risk of data exposure due to unauthenticated access.

Technical summary

The CVE record indicates an unauthenticated sensitive data exposure vulnerability exists in MPG plugin versions up to 4.2.3. The vulnerability has a CVSS score of 5.3 and a medium severity.

Defensive priority

Verify exposure in your environment and assess potential data exposure risk.

Recommended defensive actions

• Verify if your environment uses the MPG plugin and check its version.
• Assess potential exposure of sensitive data.
• Consider updating to a version beyond 4.2.3 if available.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Patchstack database has a reference to a vulnerability report.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.