CVE-2026-1233 identifies a vulnerability in the Text to Speech for WP (AI Voices by Mementor) plugin for WordPress, versions up to 1.9.8. The plugin's Mementor_TTS_Remote_Telemetry class contains hardcoded MySQL database credentials for the vendor's telemetry server. This exposure allows unauthenticated attackers to extract and decode these credentials, enabling unauthorized write access to the telemetry database. The vulnerability is categorized as CWE-798 and has a CVSS 3.1 base score of 7.5 with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available.

Exploitation of this vulnerability can lead to unauthorized write access to the vendor's telemetry database, potentially allowing attackers to manipulate telemetry data. Confidentiality of the telemetry database is compromised due to exposure of hardcoded credentials. There is no indication of impact on system integrity or availability from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting its network access to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.