The vulnerability is caused by improper neutralization of special elements in a SQL command, allowing attackers to inject arbitrary SQL statements into the database through the Media Library Assistant plugin. This can result in unauthorized data read, modification, or deletion, compromising the confidentiality and integrity of the site's data. The weakness is a classic SQL injection flaw, identified as CWE-89.

David Lingren Media Library Assistant for WordPress is affected, on every release up to and including version 3.34. A WordPress site that has not upgraded past this version is vulnerable.

The CVSS score of 8.5 classifies this as a high severity vulnerability. While the EPSS score of 2% indicates a low exploitation probability and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation remains limited. It is inferred that an attacker who can craft a request to the vulnerable endpoint can inject SQL and potentially gain full read/write access to the database table used by Media Library Assistant, as this conclusion is drawn from accessibility via the web interface. The description does not state that additional permissions are required, so it is inferred that the attack does not need extra privileges beyond web application access, making it feasible for remote adversaries with knowledge of the site structure.