CVE-2026-66600

CVE-2026-66600 is an improper authorization vulnerability in Media Library Assistant allowing author-role users to upload executable files—most likely PHP files that can be leveraged for remote code execution. The CVSS 9.1 score reflects this realistic RCE potential, not just theoretical severity. The technical failure is almost certainly a validation bypass: the plugin relies on WordPress's core upload functions without adding its own authorization constraints that properly limit what author-level users can upload. WordPress's `upload_files` capability exists to gate media uploads, but it was never designed to be a meaningful security boundary when plugins intercept and extend the upload pipeline. The core upload functions are utilities, not security enforcement points—calling them without wrapping in plugin-specific authorization checks is a pervasive pattern in WordPress plugin development. What matters practically: verify whether your deployment permits author-role users to upload PHP or other executable extensions. If the plugin permits this, it represents a fundamental mismatch between what author accounts are supposed to do (create content) and what this plugin inadvertently allows (code execution). The fix is likely an extension block or MIME type validation added to the upload handler—but a clean code patch only closes the technical gap. It does not address the organizational exposure: every day administrators operated under the assumption that author-level media upload was a bounded risk represents accumulated trust debt. You will need to re-evaluate what author-role trust means across your deployment, because the vulnerability invalidated that assumption retroactively. Author accounts are often shared with freelancers, content agencies, and external contributors—making them a lower-friction access vector than admin credentials. Successful exploitation gives you a launchpad on the same domain, same cookies, and same session context as admin panels, WooCommerce dashboards, and connected third-party integrations. The web shell is not the end state; it's the pivot point into everything else running on that WordPress instance.

Reviewed through automated stages and approved by a human before publication.