CVE-2020-11928

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-20 · updated 2026-06-17

Description

In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.

Affected products

dglingren Media Library Assistant: before 2.82 — fixed in 2.82

How to fix

Upgrade to a fixed version: dglingren Media Library Assistant 2.82. Check the vendor advisory for mitigations.

References

https://wordpress.org/plugins/media-library-assistant/#developers
https://wordpress.org/plugins/media-library-assistant/#developers

Get alerted when CVE-2020-11928 or the next vulnerability affects your stack