CVE-2023-4634

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

9.8 CriticalPublic exploit

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

85.6%Up 80.3 points since Sep 6, 2023

What each source reports

CVE List Score used 9.8

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

Record: CVE-2023-4634
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

EUVDEUVD-2023-54487 9.8

Record: EUVD-2023-54487
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8mv6-q53q-hqj8 9.8

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote...

Record: GHSA-8mv6-q53q-hqj8
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

NVD 9.8

Record: CVE-2023-4634
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Media Library Assistant Wordpress Plugin - RCE and LFI	2023-10-09
Nuclei	Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
PoC in GitHub	Evillm/CVE-2023-4634-PoC	2026-02-04
PoC in GitHub	Patrowl/CVE-2023-4634	2023-09-05

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4634 is a critical vulnerability (CVSS 9.8) in David Lingren Media Library Assistant, published September 6, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.6%, the 99th percentile. No source names a fixed version.