The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This vulnerability allows authenticated attackers with Author-level access and above to delete arbitrary files on the server from the /wp-content/uploads/ directory.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-8357 |
Exploitation
To exploit this vulnerability, an attacker with Author-level access can send a crafted request to the _process_mla_download_file function, which does not properly validate file paths. This allows the attacker to specify arbitrary file paths within the /wp-content/uploads directory, leading to unauthorized file deletion.
Affected Products
- Media Library Assistant plugin for WordPress (all versions up to and including 3.27) – This plugin allows users to manage media files but is vulnerable to file deletion due to insufficient validation.
Mitigation
To mitigate this vulnerability, it is recommended to update the Media Library Assistant plugin to the latest version where the issue has been addressed. Additionally, implementing strict file path validation and user capability checks can help prevent unauthorized file deletions.