CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Media Library Assistant versions 3.29 and earlier contain an external entity reference vulnerability that allows unauthenticated attackers to read sensitive files from the server. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 3.29 immediately.
What an attacker can do
Read sensitive files from the server without authentication.
Potential impact on your site
Attackers can access sensitive configuration files, database credentials, or other private data stored on your server.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
