SQL Injection Vulnerability in Media Library Assistant Plugin for WordPress

CVE-2024-2871

Summary

The Media Library Assistant plugin allows authenticated users with contributor access or higher to exploit an SQL Injection vulnerability. An attacker can manipulate the input through the plugin's shortcode and inject additional SQL queries into existing ones. This insufficient input validation and escaping can lead to unauthorized access and extraction of sensitive information from the WordPress database, posing a significant security risk to users. It is crucial to update the plugin to version 3.14 or later to mitigate this vulnerability.

References