Arbitrary File Deletion Vulnerability in Media Library Assistant Plugin for WordPress

CVE-2025-8357

What is CVE-2025-8357?

The Media Library Assistant plugin for WordPress is susceptible to arbitrary file deletion attacks due to inadequate file path validation and insufficient user capability checks within its _process_mla_download_file function. This vulnerability allows authenticated users with Author-level privileges or higher to delete arbitrary files from the /wp-content/uploads/ directory, potentially leading to data loss and site disruption. All versions up to and including 3.27 are affected.

References