Media Library Assistant CVE-2026-66600

Exploitation requires an authenticated WordPress account with at least Author-level privileges on a site running Media Library Assistant version 3.39 or earlier - the vulnerability is reached through the plugin's authenticated media/file upload feature, so it cannot be triggered by an anonymous visitor. No user interaction from a victim is needed (UI:N) and no special non-default plugin configuration is indicated in the description beyond having the plugin active. The practical limiting factors are therefore: possession of a valid Author (or higher) credential, the plugin being installed and active, and the target being at or below version 3.39; sites that do not grant Author accounts to untrusted parties or that disable self-registration substantially reduce realistic exposure.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) signals network-reachable, low-complexity exploitation with full confidentiality, integrity, and availability impact and a scope change consistent with breaking out of the application into the underlying host via a webshell. The key limiting signal is authentication: this is an 'Author' arbitrary file upload, meaning the attacker must already possess a valid Author (or higher) account, so it is not an unauthenticated internet-wide risk. Note a tension in the data - the vector lists PR:H, yet the WordPress Author role is a relatively low-privilege authenticated role, so PR:L is arguably more accurate; verify the intended privilege level with the Patchstack advisory. EPSS is not provided and the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation probability is currently unquantified; however, authenticated file-upload-to-RCE bugs in popular WordPress plugins are routinely weaponized against sites with open or weakly controlled registration, so any operator that grants Author accounts to semi-trusted users should treat this as urgent rather than theoretical.

An attacker who has obtained or been granted a WordPress Author account authenticates to the site and uses the plugin's file-upload functionality to submit a malicious PHP file disguised as or bypassing the media-type checks. Once the file lands in the web-accessible uploads directory, the attacker requests its URL directly to execute the code, obtaining a webshell and full server-side control. No user interaction is required and attack complexity is low, though a valid Author-level credential is a prerequisite.