CVE-2026-16959: Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector

Q: Who can exploit this issue?

An authenticated WordPress user with the Author role can exploit it. The available information does not indicate that unauthenticated visitors or lower-privileged roles can do so.

Q: Which installations are affected?

Media Library Assistant versions before 3.40 are affected. The issue is in a media-library query handler that uses the mla_search_connector search parameter.

Q: What is the recommended remediation?

Update Media Library Assistant to version 3.40 or later. If updating cannot happen immediately, restrict Author-role access to trusted users because Authors are the stated prerequisite for exploitation.

Published Aug 21, 2026

Updated

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Affected Software

1 affected component

Media Library Assistant WordPress plugin<3.40

Event History

Aug 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with the Author role can exploit it. The available information does not indicate that unauthenticated visitors or lower-privileged roles can do so.

Which installations are affected?

Media Library Assistant versions before 3.40 are affected. The issue is in a media-library query handler that uses the mla_search_connector search parameter.

What is the recommended remediation?

Update Media Library Assistant to version 3.40 or later. If updating cannot happen immediately, restrict Author-role access to trusted users because Authors are the stated prerequisite for exploitation.