Media Library Assistant: SQL injection by Contributor users
Summary
The Media Library Assistant WordPress plugin up to and including version 3.41 contains an SQL injection flaw. An authenticated user with the Contributor role can inject SQL code into database queries. Successful exploitation can expose database content such as user accounts and private data, with a CVSS 3.1 score of 8.5.
Affected
- Media Library Assistant plugin for WordPress, versions 3.41 and earlier
Fixed in
- Update to version 3.42 or later (fix named by Patchstack and the CVE record)
- Research notes report 3.43 as a later release; the installed version should be checked against the WordPress.org page
Workaround
Unknown.
- Until the update is applied, restrict or remove Contributor accounts and review who can log in (general measure, not a vendor workaround)
Exploitation
- No public proof of concept detected (third-party aggregator)
- CISA SSVC assessment: exploitation none, not automatable
- No reports of exploitation in the wild found
Our recommendation
- Update the plugin to version 3.42 or later, preferably the latest release, and verify the installed version
- Review all Contributor and higher accounts and remove unneeded ones
- Monitor the site for unusual database activity and check whether the plugin is in use at all
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory (Media Library Assistant <= 3.41) patchstack.com
- OpenCVE CVE-2026-97293 app.opencve.io
- CVE record mirror (threatint) cve.threatint.com
- WPScan plugin page Media Library Assistant wpscan.com
- WordPress.org plugin page and changelog wordpress.org
- TheHackerWire exploit status www.thehackerwire.com
- Strix CVE-2026-97293 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:42.
Original description (NVD)
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.