Quick answers
- Is CVE-2026-16959 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16959 being exploited in the wild.
- How severe is CVE-2026-16959?
- Medium severity, with a CVSS score of 6.8, published 21 August 2026.
- Which products and versions are affected?
- Download Media Library Assistant Media Library Assistant before 3.40.
- Is there a fix for CVE-2026-16959?
- A patch was published on 2026-08-20: Fixed in version 3.40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-16959 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-16959?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a classic SQL injection (CWE-89) caused by insufficient input validation on the mla_search_connector parameter before concatenation into a SQL query in the media-library query handler. The attack requires an authenticated user account with the Author role (upload_files capability) and at least one attachment in the media library. No CSRF token (nonce) is required. An attacker can craft a POST request to wp-admin/admin-ajax.php with a malicious mla_search_connector value to execute arbitrary SQL commands. The vulnerability has been patched in version 3.40; users on versions before 3.40 should upgrade immediately.
Affected products
- Download Media Library Assistant Media Library Assistant before 3.40
Timeline
- 2026-08-19: disclosed
- 2026-08-20: patched: Fixed in version 3.40