Is Media Library Assistant affected by CVE-2026-32399?

A high-severity SQL injection vulnerability affects Media Library Assistant versions 3.32 and earlier, potentially allowing attackers to extract sensitive data from organizational databases without detection.

CVE-2026-32399

Q: How to fix CVE-2026-32399?

Within 24 hours: Inventory all systems running Media Library Assistant and isolate affected instances from production networks if possible; document current version numbers. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the plugin, disable the plugin if not critical, or restrict access to trusted users only via network segmentation. Within 30 days: Evaluate migration to alternative solutions, contact the vendor for patch timeline, and conduct database audit for unauthorized access indicators.

EUVD-2026-11916 HIGH

2026-03-13 Patchstack

8.5

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11916

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 8.5

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.

Analysis

Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. …

Remediation

Within 24 hours: Inventory all systems running Media Library Assistant and isolate affected instances from production networks if possible; document current version numbers. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the plugin, disable the plugin if not critical, or restrict access to trusted users only via network segmentation. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +42

POC: 0

CVE-2026-32399 vulnerability details – vuln.today

Back

CVE-2026-32399

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-32399

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code