PT-2026-30344 · Oracle+1 · Mysql Server+1

Kazuma Matsumoto · Published 2026-04-04 · Updated 2026-04-07 · CVE-2026-1233

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Text to Speech for WP (AI Voices by Mementor) versions up to and including 1.9.8

Description The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress contains hardcoded MySQL database credentials for the vendor's external telemetry server within the Mementor TTS Remote Telemetry class. This allows unauthenticated attackers to extract and decode these credentials, potentially gaining unauthorized write access to the vendor's telemetry database.

Recommendations Update the Text to Speech for WP (AI Voices by Mementor) plugin to a version later than 1.9.8.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-1233

Affected Products

Mysql Server

Text To Speech For Wp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1233 · Security Note
• https://plugins.trac.wordpress.org/changeset/3453258/text-to-speech-tts · Note
• https://twitter.com/CVEnew/status/2040481236829995141 · Twitter Post
• https://twitter.com/atomicedgeWAF/status/2041342710649409739 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b8dc0b5e-87b9-4831-a92a-bbf6eb1346e2?source=cve · Note
• https://twitter.com/cyberbivash/status/2040418165218333027 · Twitter Post