Media Library Assistant CVE-2026-32399

Media Library Assistant plugin version 3.32 or earlier installed and activated. Attacker requires valid WordPress user login credentials (PR:L). Vulnerable parameter accepts unsanitized SQL input without proper prepared statements.

The CVSS 3.1 score of 8.5 indicates high severity with network-based attack vector (AV:N), low attack complexity (AC:L), and requirement for low privileges (PR:L). The scope change (S:C) suggests impacts beyond the vulnerable component, with high confidentiality impact (C:H) and low availability impact (A:L). However, the lack of KEV listing indicates no known active exploitation in the wild, and without EPSS data or confirmed POC availability, the real-world exploitation likelihood remains uncertain. The requirement for authentication (even with low privileges) significantly reduces the attack surface compared to unauthenticated vulnerabilities, making this a medium-priority issue for most organizations despite the high CVSS score.

An attacker with low-privileged WordPress credentials (such as a subscriber or contributor account) could craft malicious input to plugin functions that process media library queries. By injecting SQL payloads and observing application behavior differences, the attacker could systematically extract database contents including user passwords, email addresses, and potentially sensitive content through blind SQL injection techniques, where each query reveals one bit of information based on timing or error responses.