CVE-2024-51661 describes an OS command injection vulnerability in the Media LIbrary Assistant plugin by David Lingren, affecting all versions through 3.19. The vulnerability arises from improper neutralization of special elements used in OS commands, enabling command injection. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary OS commands on the affected system, potentially leading to full system compromise including loss of confidentiality, integrity, and availability. The vulnerability affects all versions of Media LIbrary Assistant up to 3.19. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict high privilege access to the Media LIbrary Assistant plugin and monitor for updates from the vendor. No official mitigation or temporary fix information is currently available.