Description

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-30T13:17:39.490Z",
  "pubdate": "2026-09-30T13:17:39.490Z",
  "executiveSummary": "The Media Library Assistant plugin for WordPress is susceptible to a SQL Injection (SQLi) vulnerability affecting versions 3.41 and earlier. This security flaw is categorized as an improper neutralization of special elements used in an SQL command, stemming from insufficient sanitization of user-supplied input.\nThe vulnerability allows a remote, authenticated attacker with contributor-level privileges or higher to execute arbitrary SQL queries against the underlying database. Successful exploitation enables unauthorized access to sensitive information, potential modification or deletion of database contents, and may lead to full administrative compromise depending on the database configuration and plugin privileges.\nThis vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress environment. Attackers can leverage this flaw to bypass application-level access controls, escalate privileges, or extract credentials stored within the WordPress database. Exploitation requires authenticated access to the WordPress dashboard with at least 'contributor' capability, making it a critical concern for multi-user WordPress installations that allow untrusted or low-privilege users access to the back-end interface.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of user-supplied parameters within the Media Library Assistant plugin’s query-building logic. Specifically, the plugin fails to utilize parameterized queries or adequate input validation when processing parameters that are subsequently appended to SQL statements. By injecting malicious SQL syntax into vulnerable input fields, an attacker can manipulate the query structure, effectively 'breaking out' of the intended data context.\nThe exploitation process typically involves an authenticated user interacting with plugin-specific features that process input parameters without sufficient sanitization. Once the malicious payload is submitted, the application engine interprets the manipulated string as part of a legitimate SQL command, executing it with the privileges of the database user configured for the WordPress instance.\nAttack flow: First, an attacker logs into the WordPress dashboard with contributor-level privileges. Second, the attacker identifies a vulnerable input vector within the plugin’s interface, such as a filter or search field that fails to sanitize input before database interaction. Third, the attacker crafts a SQL injection payload, such as a UNION-based query or time-based blind injection, to exfiltrate information or alter records. Fourth, the server-side script executes the tainted SQL command, causing the database to return unintended results or perform unauthorized modifications. Finally, the attacker captures the database output containing sensitive data or confirms the success of the injected command.\nThis vulnerability exposes the application's backend database directly, bypassing the abstraction layers provided by the WordPress core functions. Because the vulnerability resides within the plugin’s code, it affects all installations running versions 3.41 or earlier. Since the input handling logic resides within the plugin files, the exploit is persistent as long as the vulnerable version remains active. The potential for post-exploitation impact is severe, ranging from unauthorized data exfiltration of user tables, including password hashes, to the potential insertion of malicious administrative accounts or configuration changes that facilitate further persistent backdoors."
}