CVE-2024-2871 is a Medium severity (CVSS 6.4) SQL injection flaw in the Media Library Assistant WordPress plugin, in all versions up to and including 3.13. Authenticated users with contributor access or higher can read database data through shortcodes. Update to a version newer than 3.13.
What's affected
- Product: Media Library Assistant plugin for WordPress.
- Affected: all versions up to and including 3.13.
- Fixed: a version newer than 3.13. The Wordfence page returned no usable content for us, so confirm the exact release in the plugin changelog.
- Weakness: CWE-89.
- Access needed: a low privilege account (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
How to check if you're exposed
With WP-CLI on the server:
wp plugin list | grep -i media-library-assistant
Or open Plugins in the WordPress dashboard. Any version of 3.13 or lower is affected. Also check who holds the contributor role, since the flaw needs an account at that level or higher.
What to do now
- Run the WP-CLI check across every WordPress site you manage.
- Update the plugin with
wp plugin update media-library-assistant. - Review the user list for contributor accounts you do not recognise.
- Remove contributor access that is not needed.
- Back up the database before updating, as usual.
Why it matters
SQL injection happens when user input is concatenated into a database query instead of being passed as a bound parameter. The input can then change the meaning of the query and read data the user should not see.
The reliable fix is prepared statements. In WordPress code that means calling the database object's prepare method for every query that includes user supplied values.
The record says the problem is insufficient escaping of a user supplied parameter and a query that is not prepared. Contributor accounts are common on multi author sites, so the barrier is lower than the word authenticated suggests. Reachability matters here: the shortcodes only run where the plugin is active and used.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Whether a plugin flaw matters depends on whether the vulnerable code is used. The reachability demo shows how that cuts through noise.
Click through it at your own pace, or open it full screen.
Quick check
Do visitors need an account?
Yes. The record says contributor access or higher.
How do I update quickly?
Use wp plugin update media-library-assistant or the dashboard updater.
Sources
Record references (the Wordfence page returned no usable content):
- https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-custom-list.php#L151
- https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-custom-list.php#L1798
- https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-custom-list.php#L1949
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9e63fb84-a16b-447f-be73-e01f30881445?source=cve
Last reviewed: 19 October 2026.
