# CVE-2026-16959: Media Library Assistant SQL injection in search connector

Source: https://junglewise.ai/threats/cve-2026-16959-media-library-assistant-sql-injection-in-search-connector  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16959 · Severity: medium · CVSS 6.8 · Published 2026-08-21

The Media Library Assistant WordPress plugin contains a SQL injection vulnerability in its media search handler. An authenticated user with Author privileges can inject arbitrary SQL commands through an unsanitized search parameter, potentially exposing or manipulating the WordPress database. This could allow an attacker to extract sensitive data, modify posts or user information, or escalate privileges within the WordPress installation.

## Quick answers

**Is CVE-2026-16959 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16959 being exploited in the wild.

**How severe is CVE-2026-16959?** Medium severity, with a CVSS score of 6.8, published 21 August 2026.

**Which products and versions are affected?** Download Media Library Assistant Media Library Assistant before 3.40.

**Is there a fix for CVE-2026-16959?** A patch was published on 2026-08-20: Fixed in version 3.40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16959 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16959?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic SQL injection (CWE-89) caused by insufficient input validation on the mla_search_connector parameter before concatenation into a SQL query in the media-library query handler. The attack requires an authenticated user account with the Author role (upload_files capability) and at least one attachment in the media library. No CSRF token (nonce) is required. An attacker can craft a POST request to wp-admin/admin-ajax.php with a malicious mla_search_connector value to execute arbitrary SQL commands. The vulnerability has been patched in version 3.40; users on versions before 3.40 should upgrade immediately.

## Affected products

- Download Media Library Assistant Media Library Assistant before 3.40

## Timeline

- 2026-08-19: disclosed
- 2026-08-20: patched: Fixed in version 3.40

## References

- [https://wpscan.com/vulnerability/7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0/](https://wpscan.com/vulnerability/7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0/)