CVE-2025-8357: Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the processmladownloadfile function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8357?
The severity of CVE-2025-8357 is potentially high due to the risk of arbitrary file deletion.
How do I fix CVE-2025-8357?
To fix CVE-2025-8357, update the Media Library Assistant plugin to version 3.28 or later.
Who is affected by CVE-2025-8357?
CVE-2025-8357 affects all versions of the Media Library Assistant plugin up to and including version 3.27.
What kind of exploitation is possible with CVE-2025-8357?
Exploitation of CVE-2025-8357 allows an unauthorized user to delete arbitrary files from the /wp-content/uploads directory.
Is there a patch available for CVE-2025-8357?
Yes, a patch is available in the newer versions of the Media Library Assistant plugin released after 3.27.