EUVD-2026-63341
GHSA-684c-ghcx-jgxh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity upload reachable by an authenticated Author account justifies PR:L (not PR:H); webshell RCE gives full C/I/A, with scope kept Unchanged absent clear cross-security-authority breakout.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
AnalysisAI
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at least Author-level privileges on a site running Media Library Assistant version 3.39 or earlier - the vulnerability is reached through the plugin's authenticated media/file upload feature, so it cannot be triggered by an anonymous visitor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) signals network-reachable, low-complexity exploitation with full confidentiality, integrity, and availability impact and a scope change consistent with breaking out of the application into the underlying host via a webshell. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Media Library Assistant plugin to the version that supersedes 3.39 as soon as the fixed release is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-39-arbitrary-file-upload-vulnerability); the exact patched version number is not stated in the available data, so validate it against the plugin changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all users with Author-level access and revoke or restrict unnecessary privileges; enable detailed logging and monitoring of file uploads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Media Library Assistant
View allThe Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in vers
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_ga
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Au
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingre
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all ver
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter wit
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type valida
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary
Cross-Site Request Forgery in the Media Library Assistant WordPress plugin versions 3.35 and earlier allows remote attac
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using
Reflected cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.35) allow
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today