The vulnerability is caused by improper neutralization of special elements in a SQL command, allowing attackers to inject arbitrary SQL statements into the database through the Media Library Assistant plugin. This can result in unauthorized data read, modification, or deletion, compromising the confidentiality and integrity of the site's data. The weakness is a classic SQL injection flaw, identified as CWE‑89.

David Lingren Media Library Assistant for WordPress is affected, on every release up to and including version 3.34. A WordPress site that has not upgraded past this version is vulnerable.

The CVSS score of 8.5 classifies this as a high severity vulnerability. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation remains high because the affected code is reachable via the web interface of a WordPress plugin. An attacker who can craft a request to the vulnerable endpoint can inject SQL and potentially gain full read/write access to the database table used by Media Library Assistant. The attack does not require additional permissions beyond access to the web application, so it is feasible for remote adversaries with knowledge of the site structure.