Live › vulnerability › CVE-2026-115948
Go to dashboardThe media-library-assistant WordPress plugin by David Lingren does not neutralize input used in an SQL command, enabling blind SQL injection. An attacker can read database contents one inference step at a time, which can expose site data such as user records and password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
WordPress sites running media-library-assistant at version 3.42 or earlier are exposed. The flaw is reachable through the plugin's own request handling, so any site with the plugin active should be checked. Sites without the plugin installed, or with it deactivated, are not affected.
No product ranges from the sources yet.
wp plugin get media-library-assistant --field=version3.42, as released by the vendorEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.
This page as .md · .json · in your agent: get_signal("CVE-2026-115948")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.