CVE-2025-11738CWE-73

CVE-2025-11738

Medium · published October 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2025-10-18T10:15Z
References (3)
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379043%40media-library-assistant&new=3379043%40media-library-assistant&sfp_email=&sfph_mail= · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379044%40media-library-assistant&new=3379044%40media-library-assistant&sfp_email=&sfph_mail= · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/43d1264a-2265-4423-a643-7ef6436d3764?source=cve · [email protected]
EPSS history
Timeline
  • 18 OCT 05:41Z
    Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
    cvelistv5