# CVE-2026-66600: WordPress Media Library Assistant arbitrary file upload

Source: https://junglewise.ai/threats/cve-2026-66600-wordpress-media-library-assistant-arbitrary-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66600 · Severity: critical · CVSS 9.1 · Published 2026-08-20

Media Library Assistant is a popular WordPress plugin that manages media files and uploads within WordPress sites. The plugin contains an arbitrary file upload vulnerability that allows authenticated authors to upload malicious files to the server, potentially leading to complete site compromise and server takeover.

Technologies: [David Lingren Media Library Assistant](https://junglewise.ai/threats/technologies/media-library-assistant). Vendors: [David Lingren](https://junglewise.ai/threats/vendors/david-lingren).

## Quick answers

**Is CVE-2026-66600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66600 being exploited in the wild.

**How severe is CVE-2026-66600?** Critical severity, with a CVSS score of 9.1, published 20 August 2026.

**Which products and versions are affected?** David Lingren Media Library Assistant ≤ 3.39.

**Is there a fix for CVE-2026-66600?** A patch was published on 2026-08-19: Version 3.40 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66600 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66600?** Check whether you run David Lingren Media Library Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Media Library Assistant plugin versions 3.39 and earlier contain an arbitrary file upload vulnerability in its file upload handling mechanism. The vulnerability allows authenticated users with author-level privileges to bypass file type validation and upload arbitrary files (including executable code) to the server. The attack requires valid WordPress author credentials but no additional user interaction. An attacker can leverage this to upload web shells or other malicious payloads, resulting in remote code execution and complete compromise of the affected WordPress installation. The vulnerability was patched in version 3.40.

## Affected products

- David Lingren Media Library Assistant ≤ 3.39

## Timeline

- 2026-08-20: disclosed
- 2026-08-19: patched: Version 3.40 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-39-arbitrary-file-upload-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-39-arbitrary-file-upload-vulnerability?_s_id=cve)

## Related threats

- [David Lingren Media Library Assistant XSS in content injection](https://junglewise.ai/threats/cve-2026-119496-improper-neutralization-of-script-related-html-tags-in-a-web)
- [David Lingren Media Library Assistant broken access control](https://junglewise.ai/threats/cve-2026-119491-missing-authorization-vulnerability-in-david-lingren-media)
- [Media Library Assistant DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-118095-improper-neutralization-of-input-during-web-page-generation)
- [Media Library Assistant CSRF in bulk-action handler](https://junglewise.ai/threats/cve-2026-113485-the-media-library-assistant-wordpress-plugin-before-3-42-does)
- [Media Library Assistant SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-115948-improper-neutralization-of-special-elements-used-in-an-sql)