The Media Library Assistant plugin for WordPress contains an SQL injection vulnerability that allows authenticated attackers to potentially exfiltrate sensitive database information.

This vulnerability is a classic SQL injection flaw (CWE-89) triggered by the improper sanitization of user-supplied input. Based on the CVSS vector (PR:L), the attacker must possess at least low-level authenticated access to the WordPress instance to execute these malicious queries.

Successful exploitation of this vulnerability could lead to significant unauthorized data disclosure, as an attacker can manipulate database queries to extract information beyond their intended access level. With a CVSS score of 8.5, this high-severity flaw poses a substantial risk to data confidentiality and integrity, potentially leading to a full compromise of the application database.

Immediate Action: Update the WordPress Media Library Assistant plugin to version 3.35 or higher to apply the vendor-supplied security fix.

Proactive Monitoring: Review database query logs for anomalous patterns, specifically looking for unexpected SQL syntax or heavy query volumes originating from authenticated user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide temporary protection while the update is being staged.

Public Exploit Available: No (A Nuclei detection template exists, but there is no confirmed weaponized exploit or public proof-of-concept in the provided data).

Given the high CVSS score and the nature of SQL injection, administrators must treat this vulnerability with high urgency. Please verify your current plugin version immediately and apply the update to 3.35 to eliminate the injection vector and secure your database environment.