PT-2025-54443 · WordPress · Codedraft Mediabay - Wordpress Media Library Folders

Published 2025-12-31 · Updated 2025-12-31 · CVE-2025-28949

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Codedraft Mediabay - WordPress Media Library Folders versions through 1.4

Description The software contains an Improper Neutralization of Special Elements used in an SQL Command issue, specifically a Blind SQL Injection. This allows for exploitation through improper handling of special elements within SQL commands. The API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Recommendations Update Codedraft Mediabay - WordPress Media Library Folders to a version later than 1.4.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-28949

Affected Products

Codedraft Mediabay - Wordpress Media Library Folders

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-28949 · Security Note
• https://twitter.com/CveFindCom/status/2006465151227007097 · Twitter Post
• https://vdp.patchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-1-4-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2006495371006992518 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-1-4-sql-injection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-1-4-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/TheHackerWire/status/2006470353414136313 · Twitter Post
• https://t.me/CVEtracker/41118 · Telegram Post