Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-16959

Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Media Library Assistant

Default version status: unaffected

  • 0 to < 3.40affected

References