CVE-2024-3518: 
WordPress vulnerability analysis and mitigation

The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15. The vulnerability was discovered and disclosed in May 2024, affecting the WordPress plugin Media Library Assistant (NVD, Wordfence Advisory).

The vulnerability stems from insufficient escaping on user-supplied parameters and lack of sufficient preparation on existing SQL queries in the plugin's shortcode functionality. The issue has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by NIST and 8.8 (HIGH) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-89 (SQL Injection) (NVD).

Successful exploitation of this vulnerability allows authenticated attackers with contributor access or higher to append additional SQL queries to existing queries. This can be used to extract sensitive information from the database (NVD).

The vulnerability requires authentication with contributor-level access or higher to exploit. The attack complexity is considered low, requiring no user interaction for successful exploitation (NVD).

The vulnerability has been patched in version 3.16 of the Media Library Assistant plugin. Users are advised to update to this version or later to mitigate the risk (NVD).