CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.
Explanation of Vulnerability in Simple Terms
Media Library Assistant versions 3.19 and earlier contain an OS command injection vulnerability. An authenticated administrator can inject arbitrary shell commands through the plugin's file handling functions. The injected commands execute with the web server's privileges, potentially allowing full site compromise. Update to a version newer than 3.19 immediately.
What an attacker can do
Run arbitrary shell commands on the server with web server privileges.
Potential impact on your site
A compromised admin account can execute system commands, read files, modify site data, or install backdoors.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
