WordPress Plugin Vulnerabilities

Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector

Description

The plugin does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Proof of Concept

Affects Plugins

Plugin icon
media-library-assistant
Fixed in 3.40

References

CVE
CVE-2026-16959

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0

Timeline

Publicly Published
2026-08-19 (about 2 days ago)
Added
2026-08-19 (about 1 day ago)
Last Updated
2026-08-19 (about 1 day ago)

Other

Published
Title
Published
2025-04-16
Title
BMA Lite < 1.4.3 - Authenticated (Administrator+) SQL Injection
Published
2026-07-23
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.7.11 - Authenticated (Subscriber+) SQL Injection
Published
2026-03-02
Title
LatePoint < 5.2.8 - Authenticated (Administrator+) SQL Injection via JSON Import
Published
2019-07-26
Title
Photo Gallery by 10Web <= 1.5.30 - SQL Injection
Published
2021-10-11
Title
Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection