The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This vulnerability allows authenticated attackers with Author-level access and above to delete arbitrary files on the server from the /wp-content/uploads/ directory.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-8357 |
Exploitation
To exploit this vulnerability, an authenticated attacker with Author-level access can send a crafted request to the _process_mla_download_file function, bypassing the insufficient file path validation. This allows the attacker to specify arbitrary files for deletion within the /wp-content/uploads directory, potentially leading to loss of important files and disruption of service.
Affected Products
- The Media Library Assistant plugin for WordPress (all versions up to and including 3.27) is affected by this vulnerability, allowing file deletion by authenticated users.
Mitigation
To mitigate this vulnerability, it is recommended to update the Media Library Assistant plugin to the latest version where the issue has been addressed. Additionally, implementing strict file permission settings and monitoring user access levels can help prevent unauthorized file deletions.