What is the CVSS score of CVE-2025-28949?

CVE-2025-28949 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mediabay Plugin are affected by CVE-2025-28949?

The Codedraft Mediabay WordPress plugin (versions up to 1.4) allows authenticated users to execute SQL injection attacks and extract sensitive database records, including administrator credentials…

How to fix or mitigate CVE-2025-28949?

Within 24 hours, inventory all WordPress installations using Codedraft Mediabay plugin versions 1.4 and below, and audit which user accounts have plugin access. If the plugin is non-critical to business operations, disable it immediately. Within 7 days, contact the plugin vendor directly for patch availability and ETA; if no patch is forthcoming, evaluate alternative WordPress media library plugins as replacements. Within 30 days, either apply a vendor patch once available (update to the first patched version released by Codedraft) or complete migration to an alternative plugin, and review database logs for signs of SQL injection exploitation during the vulnerability window.

Mediabay Plugin CVE-2025-28949

HIGH

SQL Injection (CWE-89)

2025-12-31 audit@patchstack.com

WordPress SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Authenticated low-priv account needed (PR:L) over the network with low complexity; blind SQLi mainly reads data (C:H) within the app's own DB authority, so S:U and I/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:33 vuln.today

CVE Published

Dec 31, 2025 - 20:15 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders mediabay allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through <= 1.4.

AnalysisAI

Blind SQL injection in the Codedraft Mediabay - WordPress Media Library Folders plugin (versions up to and including 1.4) lets authenticated users inject arbitrary SQL through the plugin's mediabay functionality, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5; there is no public exploit identified at time of analysis and the EPSS probability is very low (0.03%, 7th percentile). Exploitation requires an existing low-privileged account, which limits opportunistic mass exploitation.

Technical ContextAI

The affected component is a third-party WordPress plugin, Mediabay (Media Library Folders) by Codedraft, which organizes the WordPress media library into folders. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a SQL query without proper parameterization or use of WordPress's $wpdb->prepare() API. Because the injection is 'blind,' the query results are not returned directly in the response; an attacker infers data by observing boolean or time-based differences in application behavior. The vulnerable code path runs inside the WordPress/PHP stack against the shared WordPress MySQL/MariaDB database, so any successful injection operates with the database privileges of the WordPress installation.

Affected ProductsAI

The vulnerability affects Codedraft's Mediabay - WordPress Media Library Folders plugin for WordPress, in all versions from an unspecified earliest release through and including version 1.4 (n/a through <= 1.4). No CPE string was provided in the input. The authoritative advisory is Patchstack's entry at https://patchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-1-4-sql-injection-vulnerability?_s_id=cve.

RemediationAI

No vendor-released patch version is identified in the available data, so no exact fixed release can be cited; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-1-4-sql-injection-vulnerability?_s_id=cve) and the WordPress plugin repository for any update beyond 1.4 and apply it immediately once published. Until a fixed version is confirmed, the strongest compensating control is to deactivate and remove the Mediabay plugin, which eliminates the vulnerable code path at the cost of losing the media-folder organization feature. If removal is not acceptable, tighten who can reach the vulnerable functionality by restricting or disabling new user self-registration and revoking unnecessary low-privilege accounts, since exploitation requires an authenticated session; additionally deploy a WordPress-aware WAF (such as Patchstack or Wordfence) with virtual-patching/SQLi rules to filter injection payloads, accepting that WAF rules can produce false positives and are not a substitute for a code fix.