Quick answers
- Is CVE-2026-66600 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66600 being exploited in the wild.
- How severe is CVE-2026-66600?
- Critical severity, with a CVSS score of 9.1, published 20 August 2026.
- Which products and versions are affected?
- David Lingren Media Library Assistant ≤ 3.39.
- Is there a fix for CVE-2026-66600?
- A patch was published on 2026-08-19: Version 3.40 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66600 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-66600?
- Check whether you run David Lingren Media Library Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Media Library Assistant plugin versions 3.39 and earlier contain an arbitrary file upload vulnerability in its file upload handling mechanism. The vulnerability allows authenticated users with author-level privileges to bypass file type validation and upload arbitrary files (including executable code) to the server. The attack requires valid WordPress author credentials but no additional user interaction. An attacker can leverage this to upload web shells or other malicious payloads, resulting in remote code execution and complete compromise of the affected WordPress installation. The vulnerability was patched in version 3.40.
Affected products
- David Lingren Media Library Assistant ≤ 3.39
Timeline
- 2026-08-20: disclosed
- 2026-08-19: patched: Version 3.40 released