PT-2025-49896 · WordPress · Media Library Tools

Published 2025-12-09 · Updated 2025-12-15 · CVE-2025-67520

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Media Library Tools versions through 1.6.15

Description A flaw exists in Media Library Tools that allows for SQL Injection. This issue is due to improper neutralization of special elements used in an SQL command. The vulnerability could potentially allow an attacker to manipulate database queries.

Recommendations Update Media Library Tools to a version later than 1.6.15.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67520

Affected Products

Media Library Tools

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-67520 · Security Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/media-library-tools/vulnerability/wordpress-media-library-tools-plugin-1-6-15-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2000617573675643145 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/media-library-tools/vulnerability/wordpress-media-library-tools-plugin-1-6-15-sql-injection-vulnerability?_s_id=cve · Note