CVE-2024-5605: 
WordPress vulnerability analysis and mitigation

The Media Library Assistant plugin for WordPress contains a time-based SQL Injection vulnerability (CVE-2024-5605) in versions up to and including 3.16. The vulnerability exists in the 'order' parameter within the mla_tag_cloud Shortcode due to insufficient escaping of user-supplied parameters and inadequate SQL query preparation (Wordfence, NVD).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 8.8 (HIGH). The attack vector requires network access (AV:N) with low attack complexity (AC:L) and low privileges (PR:L). No user interaction is required (UI:N), and the scope is unchanged (S:U). The impact potential is high for confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to append additional SQL queries to existing queries. This capability can be used to extract sensitive information from the database (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed through the manipulation of the 'order' parameter in the mla_tag_cloud Shortcode (NVD).

Users should upgrade to version 3.17 or later of the Media Library Assistant plugin to address this vulnerability (WordPress Plugin).