CVE-2026-77824: Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Media Cleaner (Media Sweep) pluginto a version that resolves this vulnerability.Fixed in 1.1.3 - Compensating control
Because the vulnerability is exploitable by authenticated attackers with administrator-level access and above, restrict WordPress administrator privileges to only trusted accounts and monitor/remove any accounts with unnecessary elevated access.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with administrator-level access or higher. The issue is remotely reachable, but it is not exploitable by unauthenticated or lower-privileged users based on the available information.
Which installations are affected?
Media Sweep versions up to and including 1.1.3 are affected. The provided data does not identify a fixed version or confirm whether a particular plugin configuration is required.
What could an attacker do after exploiting it?
An administrator-level attacker can use the fields parameter to append SQL queries to existing queries and extract sensitive information from the WordPress database. The available information does not indicate integrity or availability impact.
How can I assess potential exposure?
Identify sites running the Media Sweep WordPress Media Cleaner plugin at version 1.1.3 or earlier and review which accounts have administrator or higher privileges. Because exploitation uses the fields parameter, review relevant plugin REST API activity and database or web logs for suspicious requests containing that parameter, where such logging is available.