High severity · published Jun 18, 2026
CVE-2026-56012
WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows Blind SQL Injection.
This issue affects Media LIbrary Assistant: from n/a through 3.35.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Media LIbrary Assistant · David Lingren
through 3.35 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56012
patchstack.com
https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-35-sql-injection-vulnerability?_s_id=cve
More from Media LIbrary Assistant
9.1
CVE-2026-66600
WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability
8.5
CVE-2026-115948
WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability
8.5
CVE-2026-97293
WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability
8.5
CVE-2026-34885
WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability
8.5
CVE-2026-32399
WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability