CVE-2026-1233 identifies a vulnerability in the Text to Speech for WP (AI Voices by Mementor) plugin for WordPress, versions up to and including 1.9.8. The plugin contains hardcoded MySQL database credentials within the Mementor_TTS_Remote_Telemetry class. These credentials pertain to the vendor's external telemetry server. Because the credentials are hardcoded and accessible, unauthenticated attackers can extract and decode them, enabling unauthorized write access to the telemetry database. This exposure constitutes a sensitive information leak and unauthorized access risk. The vulnerability is rated with a CVSS 3.1 score of 7.5 (high severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch currently available, and the product is not a cloud service.

An unauthenticated attacker can obtain hardcoded MySQL credentials embedded in the plugin, allowing unauthorized write access to the vendor's telemetry database. This could lead to manipulation or corruption of telemetry data. The vulnerability does not directly impact confidentiality of other data or availability but exposes sensitive credentials and allows unauthorized database modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates or patches addressing this issue.