SQL Injection Vulnerability in Media Library Assistant Plugin for WordPress
CVE-2024-3518

6.5MEDIUM

Key Information:

Vendor

Wordpress
Status
Media Library Assistant
Vendor
CVE Published:
22 May 2024

What is CVE-2024-3518?

The Media Library Assistant plugin for WordPress contains a SQL Injection vulnerability that affects all versions up to and including 3.15. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries, which allows authenticated attackers with contributor access or higher to inject additional SQL commands into existing queries. This malicious activity can lead to the unauthorized extraction of sensitive data from the WordPress database, posing a significant risk to affected sites.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/media-library-...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.