CVE-2026-16959: CWE-89 SQL Injection in Media Library Assistant

CVE-2026-16959 is a SQL injection vulnerability (CWE-89) in the Media Library Assistant WordPress plugin prior to version 3.40. The plugin fails to validate a search parameter before concatenating it into a SQL query within one of its media-library query handlers. This allows users with the Author role to perform SQL injection attacks, potentially exposing sensitive information from the database. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact is limited to confidentiality, with no integrity or availability impact reported. No known exploits are currently in the wild, and no official patch links are provided in the input data.

An attacker with Author role privileges can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized disclosure of sensitive database information. There is no indication of impact on data integrity or availability. The vulnerability requires authenticated access with elevated privileges (Author role) and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role permissions where possible and monitor for suspicious activity related to media-library queries. Avoid granting Author role privileges to untrusted users.