CVE-2026-85198 is a SQL Injection vulnerability in the themeisle MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin. Versions up to and including 4.2.1 are affected. The issue stems from improper neutralization of special elements in SQL commands (CWE-89), specifically due to insufficient escaping of a user-supplied parameter and lack of prepared statements in the SQL query. Authenticated attackers with subscriber-level privileges can append additional SQL queries when the [mpg_spintax] shortcode is rendered in site-wide content, potentially extracting sensitive database information.

An attacker with subscriber-level access or higher can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not affect unauthenticated users and requires the shortcode to be active in site-wide content. There is no indication of impact on data integrity or availability, only confidentiality is affected.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid using the [mpg_spintax] shortcode in site-wide content such as footers or template parts to prevent triggering the vulnerable code path. Restrict subscriber-level user permissions where possible to reduce risk.