Low severity2.7NVD Advisory· Published Nov 12, 2024· Updated Jun 17, 2026
CVE-2024-10672
CVE-2024-10672
Description
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upsert_project_source_block() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to delete limited files on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:themeisle:multiple_page_generator:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:themeisle:multiple_page_generator:*:*:*:*:*:wordpress:*:*range: <4.0.3
- (no CPE)range: 0
- Range: <=4.0.2
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/changeset/3183330/multiple-pages-generator-by-porthas/tags/4.0.3/controllers/ProjectController.phpnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/8c21de03-4d62-4ecf-a2f1-57e0e416792bnvdThird Party Advisory
- plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/3.4.8/controllers/ProjectController.phpnvdProduct
- plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/tags/3.4.8/controllers/ProjectController.phpnvdProduct
News mentions
0No linked articles in our index yet.