SQL Injection Vulnerability in Media Library Assistant Plugin Affects Sensitive Data

CVE-2024-5605

Summary

The Media Library Assistant plugin for WordPress contains a vulnerability that exposes it to time-based SQL Injection attacks via the 'order' parameter within the mla_tag_cloud Shortcode. This issue is present in all versions up to and including 3.16, stemming from inadequate parameter escaping and insufficient preparation of the SQL query. As a result, authenticated attackers with contributor-level access and higher privileges can inject additional SQL commands into existing queries, potentially allowing them to extract sensitive information stored in the database. It is crucial for users of the plugin to apply the necessary updates to mitigate this risk.

References