CVE-2026-1233

The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TTS_Remote_Telemetry` class. This makes it possible for unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3453258/text-to-speech-tts
https://www.wordfence.com/threat-intel/vulnerabilities/id/b8dc0b5e-87b9-4831-a92a-bbf6eb1346e2?source=cve

Configurations

No configuration.

History

21 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El plugin Text to Speech for WP (AI Voices by Mementor) para WordPress es vulnerable a la exposición de información sensible en todas las versiones hasta la 1.9.8, inclusive. Esto se debe a que el plugin contiene credenciales de base de datos MySQL codificadas de forma rígida para el servidor de telemetría externo del proveedor en la clase 'Mementor_TTS_Remote_Telemetry'. Esto permite a atacantes no autenticados extraer y decodificar estas credenciales, obteniendo acceso de escritura no autorizado a la base de datos de telemetría del proveedor.

04 Apr 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-04 12:16

Updated : 2026-07-21 19:10

NVD link : CVE-2026-1233

Mitre link : CVE-2026-1233

CVE.ORG link : CVE-2026-1233

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-1233", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1233", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:44:47.813176Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "mvirik", "product": "Text to Speech \u2013 TTSWP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-04T12:16:02.943", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3453258/text-to-speech-tts", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8dc0b5e-87b9-4831-a92a-bbf6eb1346e2?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TTS_Remote_Telemetry` class. This makes it possible for unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database."}, {"lang": "es", "value": "El plugin Text to Speech for WP (AI Voices by Mementor) para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 1.9.8, inclusive. Esto se debe a que el plugin contiene credenciales de base de datos MySQL codificadas de forma r\u00edgida para el servidor de telemetr\u00eda externo del proveedor en la clase 'Mementor_TTS_Remote_Telemetry'. Esto permite a atacantes no autenticados extraer y decodificar estas credenciales, obteniendo acceso de escritura no autorizado a la base de datos de telemetr\u00eda del proveedor."}], "lastModified": "2026-07-21T19:10:00.107", "sourceIdentifier": "security@wordfence.com"}