A vulnerability described as critical has been identified in mvirik Text to Speech Plugin up to 1.9.8 on WordPress. The impacted element is the function
Mementor_TTS_Remote_Telemetry. Executing a manipulation can lead to hard-coded credentials.
This vulnerability appears as CVE-2026-1233. The attack may be performed from remote. There is no available exploit.