CVE-2024-3518 is an SQL Injection vulnerability in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.15. The issue arises from improper neutralization of special elements in SQL commands due to insufficient escaping of user-supplied parameters and lack of prepared statements in the plugin's shortcode processing. Authenticated attackers with contributor-level access or higher can append additional SQL queries to existing ones, enabling extraction of sensitive database information. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated user with contributor or higher privileges to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive data, modification of database contents, and disruption of service. The vulnerability compromises confidentiality, integrity, and availability of the affected WordPress site’s database.

No official patch or fix is currently available for this vulnerability as per the provided data. Users should monitor the vendor's advisories for updates and consider restricting contributor-level access until a fix is released. Applying principle of least privilege and disabling or removing the Media Library Assistant plugin if not essential can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.