Vulnerability · Published Aug 21, 2026 · Assigned by WPScan
CVE-2026-16959Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
Medium 6.8
In plain English
A medium-severity SQL injection in Media Library Assistant from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)1.3%top 29.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Media Library Assistant | 0 – before 3.40 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
References
- https://wpscan.com/vulnerability/7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0/ exploit, vdb-entry, technical-description