What is the CVSS score of CVE-2026-32399?

CVE-2026-32399 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Media Library Assistant are affected by CVE-2026-32399?

A high-severity SQL injection vulnerability affects Media Library Assistant versions 3.32 and earlier, potentially allowing attackers to extract sensitive data from organizational databases without…

How to fix or mitigate CVE-2026-32399?

Within 24 hours: Inventory all systems running Media Library Assistant and isolate affected instances from production networks if possible; document current version numbers. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the plugin, disable the plugin if not critical, or restrict access to trusted users only via network segmentation. Within 30 days: Evaluate migration to alternative solutions, contact the vendor for patch timeline, and conduct database audit for unauthorized access indicators.

Media Library Assistant CVE-2026-32399

EUVD-2026-11916 HIGH

SQL Injection (CWE-89)

2026-03-13 Patchstack

SQLi Media Library Assistant

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11916

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.

AnalysisAI

Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary SQL queries over the network, potentially leading to unauthorized data access and service disruption. The vulnerability requires valid user credentials but no user interaction, making it exploitable by internal or compromised accounts with minimal effort. No patch is currently available for affected installations.

Technical ContextAI

The Media Library Assistant is a WordPress plugin that enhances media management capabilities within the WordPress content management system. The vulnerability stems from improper neutralization of special elements used in SQL commands (CWE-89), a classic SQL injection flaw where user input is not properly sanitized before being incorporated into database queries. This allows attackers to inject malicious SQL code that can be executed by the database engine, specifically through blind SQL injection techniques where data is extracted based on true/false responses rather than direct output.

RemediationAI

Upgrade the Media Library Assistant plugin to a version newer than 3.32 if available from the plugin developer. In the absence of specific patch information or vendor advisory links in the provided data, administrators should check the WordPress plugin repository or contact the plugin developer directly for update availability. As an interim mitigation, consider restricting access to WordPress admin functionality to trusted IP addresses only, implementing Web Application Firewall (WAF) rules to detect SQL injection attempts, and monitoring database query logs for suspicious activity.