CVE-2026-16959

This SQL injection in the media library search handler carries a blast radius that the CVSS score of 6.8 dramatically understates. The vulnerability requires an Author-level account to exploit, which creates a dangerous false security boundary that defenders often treat as sufficient mitigation. It is not. Authors in WordPress can upload media files, which means this injection chains directly to filesystem write access — and in most WordPress configurations, that equals RCE. The capability check reduces exploitability by roughly 80% in scanner terms, but transforms the vulnerability from 'any authenticated user' to 'any compromised Author account' — which is the exact privilege level many deployments extend to contractors, guest contributors, and third-party integrators. If your site has Authors you do not fully trust, treat this as a critical priority regardless of the moderate EPSS score. The pattern is well-documented in the WordPress plugin ecosystem: developers skip prepared statements in 'internal' query paths because capability checks feel like enough security. It is not. The trust model built into WordPress roles (sandboxing users from each other) does not extend to query paths — developers who treat Author-level users as 'low risk' are applying an authorization model to an input-safety problem. Check whether your deployment grants Author role to any user outside your immediate team. If so, patch immediately and audit for other handlers in your plugin ecosystem that may have inherited the same assumption — that capability-gated paths don't need input validation.

Reviewed through automated stages and approved by a human before publication.