CVE-2024-2871

The Media Library Assistant plugin for WordPress contains a SQL injection flaw in its shortcode functionality affecting versions 3.13 and earlier, caused by inadequate escaping of user input and insufficient query preparation. Authenticated users with at least contributor-level permissions can inject malicious SQL code to modify existing database queries and retrieve sensitive data. The vulnerability requires an authenticated attacker but poses a significant risk to database security and confidentiality of stored information.

Based on public CVE data (MITRE/NVD).