Media Library Assistant prior to version 3.40 concatenates an unchecked search parameter directly into a SQL query. This omission allows any site user with the Author role to inject arbitrary SQL statements. The vulnerability enables data read/write or database manipulation, potentially exposing sensitive data or altering site content.

The affected product is the Media Library Assistant WordPress plugin, any installation running a version lower than 3.40. The plugin is commonly used in WordPress sites for media management.

The CVSS score is 6.8 and the EPSS score is <1%, indicating moderate severity and low likelihood of exploitation. Attacker must be authenticated with at least the Author role, so the vulnerability only applies to legitimate users on the site. No public exploit references are available, and it is not listed in the KEV catalog. Nonetheless, because the flaw permits arbitrary SQL execution, the impact could be severe if not mitigated promptly.