CVE-2026-115948: WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

Q: What access does an attacker need to exploit this issue?

The attack vector is network-based and requires low privileges. No user interaction is required.

Q: How can I determine whether an installation is affected?

Installations running Media Library Assistant version 3.42 or earlier are in the affected range described by the advisory.

Q: What is the expected security impact?

The CVSS vector indicates high confidentiality impact and low availability impact, with no integrity impact listed. The scope is marked as changed.

Published Oct 26, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.

Affected Software

1 affected component

David Lingren Media Library Assistant<=3.42

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Media Library Assistant to a version that resolves this vulnerability.
Fixed in 3.43

Event History

Oct 26, 2026

CVE Published

via MITRE·10:08 AM

Data Sourced

via MITRE·10:08 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack vector is network-based and requires low privileges. No user interaction is required.

How can I determine whether an installation is affected?