CVE-2025-8357CWE-862

Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion

Medium · published August 19, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-08-19T04:26Z
EPSS history
Timeline
  • 19 AUG 04:26Z
    Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
    cvelistv5