CVE-2025-11738: Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11738?
CVE-2025-11738 is classified as a medium severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-11738?
To remediate CVE-2025-11738, update the Media Library Assistant plugin to the latest version beyond 3.29.
What types of files can be accessed due to CVE-2025-11738?
CVE-2025-11738 allows attackers to read the contents of ai, eps, pdf, and ps files on the server.
Is CVE-2025-11738 exploitable by authenticated users?
No, CVE-2025-11738 can be exploited by unauthenticated attackers.
Which versions of the Media Library Assistant are affected by CVE-2025-11738?
All versions of the Media Library Assistant plugin up to and including 3.29 are affected by CVE-2025-11738.