Media Library Assistant CVE-2026-16959

Exploitation requires a valid WordPress user account holding at minimum the Author role - unauthenticated visitors, Subscribers, and Contributors cannot trigger the vulnerability. The affected code path is the media-library search query handler within the plugin, which must be active and accessible to Author-role users (this is the default configuration when the plugin is installed). No non-default WordPress configuration is required beyond having the Media Library Assistant plugin installed and unpatched (before 3.40). Exploitation is bounded by the read-only nature of the injection path per CVSS I:N and A:N - write or destructive SQL operations do not appear to be exposed through this handler, though this should be independently verified. Threat is highest in multi-author publishing environments where Author accounts are distributed to less-trusted contributors.

The vendor-assigned CVSS base score of 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N reflects a moderate-to-high concern, but contains a notable discrepancy: the PR:H (High Privileges) designation is inconsistent with the WordPress Author role, which is a low-trust authenticated role that can publish posts without administrative access. PR:L would be a more accurate representation, which independently assessed would push the base score into the High range (~8.5). The scope change (S:C) and high confidentiality impact (C:H) are plausible for SQL injection that can enumerate or exfiltrate the full WordPress database. No CISA KEV listing was found, meaning active exploitation is not confirmed, but a publicly available POC (reported by WPScan) substantially elevates the realistic exploitation probability beyond what the raw score suggests. Integrity and availability are both rated None, suggesting this is a read-only injection path - defenders should verify whether the specific query handler allows write operations. Exploitation requires at minimum an Author-level account, which limits opportunistic mass exploitation but is a realistic threat in multi-author WordPress environments.

An attacker with a WordPress Author account on a target site crafts a malicious SQL payload embedded in the search parameter of a media-library query request. Because the plugin concatenates this value directly into a SQL statement, the injected SQL executes against the WordPress database, enabling the attacker to enumerate tables and extract sensitive data such as hashed passwords, email addresses, or other stored content. A publicly available POC exists per the WPScan disclosure, meaning exploitation requires minimal SQL injection expertise.