SQL Injection Vulnerability in Media Sweep Plugin for WordPress
CVE-2026-77824

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Media Sweep – WordPress Media Cleaner
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77824?

The Media Sweep plugin for WordPress suffers from a SQL Injection vulnerability that allows authenticated attackers with administrator-level access to manipulate SQL queries. This occurs due to insufficient escaping of user-supplied input in the 'fields' parameter. As a result, attackers can append additional SQL commands, potentially granting them access to sensitive information stored in the database, thus posing a significant risk to the integrity and confidentiality of the affected system.

Affected Version(s)

Media Sweep – WordPress Media Cleaner 0 <= 1.1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/media-sweep/ta...
https://plugins.trac.wordpress.org/browser/media-sweep/ta...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.