CVE-2026-16959: Media Library Assistant SQLI Vulnerability

CVE-2026-16959 Overview

CVE-2026-16959 is a SQL Injection vulnerability in the Media Library Assistant WordPress plugin before version 3.40. The plugin fails to validate a search parameter before concatenating it into a SQL query within one of its media-library query handlers. Authenticated users with the Author role can inject malicious SQL statements through this parameter. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated Authors can execute arbitrary SQL queries against the WordPress database, potentially exposing sensitive data including password hashes, user metadata, and site secrets.

Affected Products

Media Library Assistant WordPress plugin versions prior to 3.40
WordPress installations that grant the Author role to untrusted users
Multi-author WordPress sites using the plugin for media queries

Discovery Timeline

2026-08-21 - CVE-2026-16959 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16959

Vulnerability Analysis

The Media Library Assistant plugin extends WordPress media management with advanced query, taxonomy, and shortcode features. One of its media-library query handlers accepts a user-controlled search parameter and concatenates it directly into a SQL statement. Because the plugin does not sanitize or parameterize this input, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires an authenticated account with at least Author privileges. Author is a low-trust role on multi-contributor WordPress sites, which makes the attack surface larger than admin-only flaws. Successful injection lets attackers read arbitrary rows from the wp_users, wp_usermeta, and wp_options tables, including password hashes and site secrets.

The scope-changed nature of the flaw reflects that the injected query executes with the database privileges of the WordPress service account, which typically has full access to every table in the site database.

Root Cause

The root cause is unsanitized concatenation of a search parameter into a raw SQL query. The plugin does not use $wpdb->prepare() with placeholder binding, nor does it apply esc_sql() or a strict allowlist to the input. This violates the standard WordPress database API guidance for handling user input in SQL statements.

Attack Vector

The vulnerability manifests in one of the plugin's media-library query handlers. An authenticated Author sends a crafted request containing SQL metacharacters in the vulnerable search parameter. The plugin appends the payload to a SELECT statement without escaping, allowing UNION-based extraction, boolean-based blind inference, or time-based blind extraction using SLEEP().

For technical payload details, see the WPScan Vulnerability Report.

// No verified proof-of-concept code is published.
// See the WPScan advisory for exploitation details.

Detection Methods for CVE-2026-16959

Indicators of Compromise

Requests from Author-level accounts containing SQL metacharacters such as UNION SELECT, SLEEP(, --, or /* in Media Library Assistant search parameters.
Unusual SELECT queries in MySQL slow query or general logs originating from the WordPress database user.
Unexpected outbound requests or data exports following Author-authenticated sessions.
WordPress audit log entries showing Author accounts accessing media query endpoints at high frequency.

Detection Strategies

Deploy a web application firewall rule that inspects requests to Media Library Assistant endpoints for SQL injection signatures.
Enable MySQL query logging and alert on queries containing sleep functions, information_schema references, or stacked UNION clauses tied to the plugin's handler.
Correlate WordPress authentication events with anomalous request patterns from Author-role accounts.

Monitoring Recommendations

Monitor plugin version inventory across WordPress fleets and flag any installation of Media Library Assistant below 3.40.
Review WordPress user role assignments and identify accounts with Author privileges that no longer require them.
Track outbound traffic from WordPress hosts for signs of database exfiltration following suspicious authenticated requests.

How to Mitigate CVE-2026-16959

Immediate Actions Required

Update the Media Library Assistant plugin to version 3.40 or later on every WordPress site.
Audit all Author-role accounts and disable or downgrade accounts that do not require content creation privileges.
Rotate WordPress secrets, database credentials, and administrator passwords if exploitation is suspected.
Review recent activity logs for Author accounts interacting with media-library query endpoints.

Patch Information

The vendor addressed the flaw in Media Library Assistant version 3.40 by validating and safely binding the search parameter before use in the SQL query. Refer to the WPScan Vulnerability Report for advisory details and patch metadata.

Workarounds

Restrict the Author role using a capability manager plugin until the update can be applied.
Place a web application firewall in front of the WordPress site with rules blocking SQL metacharacters in plugin query parameters.
Deactivate the Media Library Assistant plugin on sites where an immediate update is not feasible.

bash

# Update the plugin via WP-CLI
wp plugin update media-library-assistant --version=3.40
wp plugin list --name=media-library-assistant --fields=name,status,version