Media Library Assistant EUVD-2026-109721

Exploitation requires an authenticated account on the target WordPress site: the CVSS vector specifies PR:L, so a low-privileged (but valid) user is needed, which is the primary limiting factor. The available sources do not name the specific feature, endpoint, or parameter that is injectable, so the exact trigger is not described in the available sources - only that Media Library Assistant versions up to and including 3.42 are affected (no fixed version is stated in the input). No user interaction is required (UI:N) and the vector is network-reachable (AV:N), but the authentication requirement means this is not exploitable against anonymous visitors on a default install.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity blind SQL injection that requires some level of authenticated access (PR:L), and the vendor-assigned score of 8.5 is inflated largely by the scope-change flag (S:C) and the confidentiality impact (C:H). The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a serious issue that warrants prompt patching rather than drop-everything response. No EPSS probability and no SSVC automatable/technical-impact fields were supplied, so I cannot quantify exploitation likelihood; absence of these is a data gap, not a low score. This is not listed in CISA KEV and no working exploit was provided - only a Patchstack advisory reference. The PR:L requirement is the key risk limiter: an attacker needs a valid (even low-privileged) account on the WordPress site, which meaningfully narrows the threat versus a fully unauthenticated flaw. Net: a real, patch-worthy authenticated SQLi, but the authentication prerequisite and the lack of confirmed exploitation place it below internet-wide-unauthenticated-RCE urgency.

An authenticated low-privileged WordPress user (PR:L) sends a crafted request to an affected Media Library Assistant endpoint, injecting SQL into an unsanitized parameter to perform blind SQL injection against the site database. Because the injection is blind, the attacker infers data (e.g., password hashes, secrets, other users' data) through boolean/time-based responses rather than direct output. No public working exploit was provided - only a Patchstack advisory reference - so exploitation currently requires the attacker to develop the injection payload themselves.