{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/media-library-assistant--3.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2023-4634"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Media Library Assistant (\u003c 3.10)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2023-4634 is a critical vulnerability affecting the WordPress Media Library Assistant plugin versions prior to 3.10. The vulnerability stems from insecure handling of image processing via the Imagick library, allowing an unauthenticated attacker to achieve remote code execution (RCE). By orchestrating a complex interaction between a target WordPress site and remote attacker-controlled FTP and HTTP servers, an adversary can force the server to download and process malicious SVG/MSL (Magick Scripting Language) files. This process ultimately results in the creation of a polyglot PHP file on the web server, which provides the attacker with command execution capabilities. Due to the public availability of functional exploit scripts, this vulnerability presents an immediate risk to organizations running unpatched versions of the plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sets up a remote FTP server hosting crafted polyglot SVG/MSL files and a remote HTTP server hosting a polyglot PNG/PHP file containing a web shell payload.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target WordPress site running a vulnerable version of the Media Library Assistant plugin.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the vulnerability by sending a request to the target site, pointing it to the malicious files hosted on the attacker's FTP server.\u003c/li\u003e\n\u003cli\u003eThe plugin's image processing function, utilizing the Imagick library, fetches and processes the malicious SVG/MSL files from the FTP server.\u003c/li\u003e\n\u003cli\u003eThe processing of the MSL script instructs the server to fetch the polyglot PNG/PHP file from the attacker's HTTP server.\u003c/li\u003e\n\u003cli\u003eThe Imagick library saves the fetched PNG content as a .php file on the victim's filesystem, typically within the web server's document root.\u003c/li\u003e\n\u003cli\u003eThe attacker accesses the newly dropped PHP file directly via a web browser to execute the included payload and achieve arbitrary command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full compromise of the underlying web server, allowing for unauthorized data access, modification, or the installation of persistent backdoors. The vulnerability has a CVSS 9.8 score, reflecting its high potential for complete system takeover without requiring authentication or user interaction.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Media Library Assistant WordPress plugin to version 3.10 or later immediately to resolve CVE-2023-4634.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for anomalous requests to the WordPress media upload or library endpoints that reference external, non-whitelisted domains or protocols (e.g., ftp://).\u003c/li\u003e\n\u003cli\u003eMonitor the web server filesystem for the creation of unexpected .php files within standard image/media upload directories.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of the web server process (e.g., www-data) to initiate outbound network connections to arbitrary external hosts, specifically limiting FTP and high-port HTTP requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T19:44:33Z","date_published":"2026-10-16T19:44:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2023-4634/","summary":"An unauthenticated remote code execution vulnerability (CVE-2023-4634) in the WordPress Media Library Assistant plugin versions before 3.10 allows attackers to leverage Imagick processing for arbitrary code execution.","title":"Unauthenticated Remote Code Execution in WordPress Media Library Assistant Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2023-4634/"}],"language":"en","title":"CraftedSignal Threat Feed - Media Library Assistant (\u003c 3.10)","version":"https://jsonfeed.org/version/1.1"}