Arbitrary File Upload Vulnerability in Media Library Assistant Plugin

CVE-2024-6823

Summary

The Media Library Assistant plugin for WordPress contains a vulnerability that allows authenticated users with Author-level access and above to perform arbitrary file uploads due to insufficient file type validation. This security flaw occurs in the mla-inline-edit-upload-scripts AJAX action, which does not adequately restrict the types of files that can be uploaded. As a result, attackers may exploit this vulnerability to upload malicious files to the server hosting the affected WordPress site. This could potentially lead to remote code execution, enabling further exploitation of the site.

References