The Media Library Assistant plugin, versions 3.39 and older, contains an arbitrary file upload flaw. An attacker who can submit a file through the plugin interface can place executable code or malicious files on the server. Successful exploitation would allow the attacker to execute code with the permissions of the web server process, leading to total compromise of the affected WordPress installation. The weakness – file type validation failure – directly threatens the confidentiality, integrity, and availability of site data. The vulnerability is identified as CWE‑434.

The flaw affects the Media Library Assistant plugin developed by David Lingren. WordPress sites installing any version of the plugin up to and including 3.39 are vulnerable. Users should verify the plugin version and update if necessary. No other products or vendors are listed as affected.

The CVSS score of 9.1 indicates critical severity. EPSS data is not available, so the probability of exploitation is unknown, but the lack of a KEV listing suggests no widespread exploitation has been reported yet. The likely attack vector is remote: the plugin’s upload function is accessible through the WordPress admin interface, and if injected files execute, the attacker can run arbitrary code. The impact is immediate if the upload point is reachable before patching; therefore, the risk is high for unpatched sites.