The Media Library Assistant plugin contains an improper neutralization of special elements in an SQL command, enabling blind SQL injection. This flaw allows an attacker to craft inputs that are injected into database queries, potentially extracting sensitive data, modifying or deleting database records, and thereby compromising the confidentiality, integrity, and availability of the site content. The weakness is classified as CWE-89.

The vulnerability affects the Media Library Assistant plugin developed by David Lingren, versions from the initial release through 3.42. The plugin integrates with WordPress sites and any installation using an affected version is at risk.

With a CVSS score of 8.5, the vulnerability is considered high severity. Although an EPSS score is not available, the lack of a KEV listing does not diminish the potential for exploitation, as the attack can be carried out remotely by submitting malicious input to the plugin’s interfaces. It is inferred that the attack vector is external, via the web application, and does not require prior authentication. The risk is significant given the capability to compromise database contents.