Description

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-21T07:16:24.940Z",
  "pubdate": "2026-08-21T07:16:24.940Z",
  "executiveSummary": "The Media Library Assistant WordPress plugin contains a SQL injection vulnerability that permits authenticated users assigned the Author role to execute arbitrary SQL commands.\nThe flaw stems from the insecure handling of a search parameter within a media-library query handler, where user-supplied input is concatenated directly into a database query without prior validation or sanitization.\nSuccessful exploitation of this vulnerability allows attackers to manipulate database queries, potentially leading to unauthorized data access, sensitive information disclosure, or further compromise of the underlying WordPress database.\nThe risk implication is significant as it elevates the privileges of an Author-level user, bypassing intended access controls and application logic through database-level interaction.\nExploitation requires authenticated access with at least the Author role and the ability to interact with the vulnerable query handler endpoint.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper input validation and sanitization of a search parameter before it is concatenated into a SQL query.\nThe vulnerable component resides within one of the media-library query handlers of the Media Library Assistant plugin, affecting versions prior to 3.40.\nAuthentication and privilege requirements dictate that the attacker must possess an active user account with the Author role or higher on the target WordPress instance.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious HTTP request targeting the media-library query handler, injecting SQL metacharacters into the vulnerable search parameter. Second, the plugin receives the input and directly concatenates the unsanitized search string into the construction of the database query. Third, the underlying database management system executes the resulting malformed query, interpreting the injected payload as native SQL commands rather than literal search data.\nPayload behavior involves altering the logical structure of the SQL query, enabling the retrieval of unauthorized data sets, metadata, or other sensitive information stored within the WordPress database tables.\nPost-exploitation impact includes unauthorized database enumeration, extraction of sensitive application data, and potential compromise of system integrity depending on the database user privileges and database engine configuration."
}