What is the CVSS score of CVE-2026-34885?

CVE-2026-34885 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-34885?

The Media Library Assistant WordPress plugin (versions ≤3.34) contains a SQL injection vulnerability that allows authenticated users with minimal privileges to access sensitive database information…

Is there a public PoC exploit available for CVE-2026-34885?

Yes, a public proof-of-concept exploit is available for CVE-2026-34885. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-34885?

Within 24 hours: Identify all WordPress instances running Media Library Assistant plugin and document current versions. Within 7 days: Disable or uninstall Media Library Assistant plugin immediately as no vendor patch is available; evaluate alternative media management solutions and migrate content if necessary. Within 30 days: Complete migration to patched or alternative plugin; implement principle of least privilege access controls limiting user roles; conduct database audit for unauthorized access indicators.

Wordpress Plugin CVE-2026-34885

EUVD-2026-19309 HIGH

SQL Injection (CWE-89)

2026-04-06 audit@patchstack.com

GHSA-39w8-449c-wqw6

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19309

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.34.

AnalysisAI

SQL injection in WordPress Media Library Assistant plugin through version 3.34 allows authenticated attackers with low-level privileges to extract sensitive database contents and potentially disrupt availability. The vulnerability has a CVSS score of 8.5 (High) with scope change, indicating authenticated attackers can access data beyond their permission level. EPSS data not available; no public exploit identified at time of analysis. No CISA KEV listing indicates this is not confirmed as actively exploited in the wild.

Technical ContextAI

This is a CWE-89 SQL Injection vulnerability in the WordPress Media Library Assistant plugin, a widely-deployed media management extension for WordPress installations. SQL injection occurs when user-controlled input is improperly sanitized before being incorporated into SQL queries, allowing attackers to manipulate database queries by injecting malicious SQL code. The affected plugin component (Media Library Assistant versions through 3.34) fails to neutralize special SQL characters in user input, enabling authenticated users to execute arbitrary SQL commands against the WordPress database. The vulnerability affects the WordPress ecosystem's plugin architecture, where third-party code operates with database access privileges. Given the WordPress platform's market dominance and the plugin's media management role, this vulnerability could expose site media metadata, user information, post content, and other database-stored data to unauthorized access.

RemediationAI

Organizations should immediately upgrade the Media Library Assistant plugin to a version newer than 3.34 if a patched version has been released by the vendor. Check the WordPress plugin repository or the official plugin website for the latest secure version and apply updates through the WordPress admin dashboard or via manual installation. If an updated version is not yet available, consider temporarily disabling the Media Library Assistant plugin until a patch is released, and evaluate alternative media management solutions for critical production environments. As an interim mitigation measure, restrict authenticated user account creation and audit existing low-privilege user accounts to ensure only trusted users have WordPress access, reducing the attack surface since exploitation requires PR:L (low-privilege authentication). Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the vulnerable plugin endpoints. Monitor database query logs for suspicious activity patterns indicative of SQL injection attempts, such as UNION-based queries, time-based blind injection patterns, or information_schema enumeration queries. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-34-sql-injection-vulnerability for additional technical details and indicators of compromise. After patching, conduct database integrity verification to ensure no unauthorized data exfiltration or modification occurred during the vulnerability window.