CVE-2023-4634 in the critical feed json
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
published 2023-09-06 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-54487
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 85.6%
- EPSS 85.6% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
Patch / fix
- davidlingren media_library_assistant 3.10
Timeline
- Published
- First public exploit (EDB-51737)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
85.59% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-51737 Media Library Assistant Wordpress Plugin - RCE and LFI webapps, 2023-10-09
- Nuclei template Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion nuclei detection template
- patrowl.io https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/ referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/Patrowl/CVE-2023-4634/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- dglingren Media Library Assistant
Classification
- Weakness
-
- CWE-73 External Control of File Name or Path
- Technology feeds
References
-
plugins.trac.wordpress.org
/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-a
patch
-
patrowl.io
/blog-wordpress-media-library-rce-cve-2023-4634/
exploit, third-party-advisory
-
github.com
/Patrowl/CVE-2023-4634/
exploit, third-party-advisory
-
wordfence.com
/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve
third-party-advisory
-
packetstormsecurity.com
/files/174508/wpmla309-lfiexec.tgz
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2023-4634
- NVD CVE-2023-4634
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.