CVE-2024-6823highCWE-434

CVE-2024-6823: high-severity vulnerability in dglingren Media Library Assistant

Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action

Published · Updated

Follow this CVE+ Monitor Media Library Assistant

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.3%
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
dglingren · Media Library Assistant
Related CVEs — dglingren Media Library Assistant

In the same product, most dangerous first.

CVE-2023-4634CRITICALMedia Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code ExecutionEPSS 85.6%CVE-2024-5605HIGHMedia Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order ParameterEPSS 0.6%CVE-2023-4716MEDIUMMedia Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-3518HIGHMedia Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.5%CVE-2024-2871MEDIUMMedia Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via ShortcodeEPSS 0.5%CVE-2024-2475MEDIUMMedia Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery ShortcodeEPSS 0.4%