CVE-2026-1233
Hardcoded Credentials in WP Text to Speech Plugin Expose Database
Publication date: 2026-04-04
Last updated on: 2026-04-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mementor | text-to-speech-for-wp | to 1.9.8 (inc) |
| mementor | text-to-speech-for-wp | to 1.9.3 (exc) |
| mementor | text-to-speech-for-wp | 1.9.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1233 is a security vulnerability in the Text to Speech for WP (AI Voices by Mementor) WordPress plugin, affecting all versions up to and including 1.9.8.
The vulnerability arises because the plugin contains hardcoded MySQL database credentials for the vendor's external telemetry server within its code. These credentials are stored as base64-encoded strings that can be decoded by attackers.
This allows unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to gain unauthorized write access to the telemetry database used by the plugin vendor.
Since the database credentials are exposed in the plugin code, attackers can extract them without authentication and potentially manipulate or corrupt telemetry data.
While the vulnerability does not directly affect the confidentiality or availability of your own WordPress site, it compromises the security of the vendor's telemetry infrastructure, which could lead to further indirect risks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the installed version of the Text to Speech for WP (AI Voices by Mementor) plugin is up to and including version 1.9.8, as these versions contain hardcoded MySQL database credentials.
Additionally, detection can involve searching the plugin files for the presence of base64-encoded database credentials within the Mementor_TTS_Remote_Telemetry class or scanning for direct database connection attempts using mysqli functions.
- Use a command to find base64-encoded strings in the plugin directory, for example: grep -r 'base64_decode' wp-content/plugins/text-to-speech-tts/
- Search for the presence of the vulnerable class or direct database connection code: grep -r 'Mementor_TTS_Remote_Telemetry' wp-content/plugins/text-to-speech-tts/
- Check the plugin version installed via WP-CLI: wp plugin list | grep text-to-speech-tts
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Text to Speech for WP (AI Voices by Mementor) plugin to version 1.9.9 or later, where the vulnerability has been fixed.
Version 1.9.9 removes the direct database connection method and replaces it with a secure HTTPS POST request to a remote telemetry API using HMAC-SHA256 authentication, eliminating exposure of database credentials.
If updating immediately is not possible, consider disabling the plugin temporarily to prevent exploitation.
Also, review your telemetry data access logs and database access logs for any unauthorized access attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability exposes hardcoded MySQL database credentials in the plugin, allowing unauthenticated attackers to gain unauthorized write access to the vendor's telemetry database.
This exposure of sensitive information could lead to unauthorized access to telemetry data, which may include user or system information, thereby potentially violating data protection regulations such as GDPR or HIPAA that require safeguarding sensitive data against unauthorized access.
The fix implemented in version 1.9.9 removes direct database connections and replaces them with secure HTTPS POST requests using HMAC authentication, which improves the security posture and helps in maintaining compliance with such standards by protecting sensitive credentials and data transmission.