CVE-2023-4634: WordPress Media Library Assistant unauthenticated LFI and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network exploitation, public exploit code, and very high EPSS make this an urgent patch.

What it is

The Media Library Assistant plugin for WordPress up to and including 3.09 fails to properly control file paths passed to the 'mla_stream_file' parameter in ~/includes/mla-stream-image.php, where images are processed via Imagick(). This allows unauthenticated attackers to perform directory listing, local file inclusion, and remote code execution.

Impact

An unauthenticated attacker can read local files and execute arbitrary code on the affected WordPress server, leading to full compromise of the host.

Attack surface

Reachable over the network through the plugin's image streaming endpoint with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description notes attackers can supply files via FTP to enable directory listing, LFI, and RCE.

Exploitation

Public exploit code exists (Patrowl GitHub and blog, Packet Storm) and EPSS is 0.8589 (99.7th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Update the Media Library Assistant plugin to a version newer than 3.09 (patch changeset 2955933).
• If patching is not immediately possible, disable or remove the plugin.
• Restrict FTP access and file upload paths used by the web server to limit attacker-supplied files.
• Harden Imagick and PHP file handling to block path traversal and remote file references.
• Monitor and restrict outbound network access from the WordPress host to reduce RCE impact.

Detection

• Inspect web server logs for requests to mla-stream-image.php with suspicious 'mla_stream_file' values containing path traversal or remote URLs.
• Alert on unexpected FTP uploads or new files in web-accessible directories.
• Monitor for Imagick or PHP processes spawning shell commands or making outbound connections.
• Use file integrity monitoring on the WordPress plugins directory to detect unauthorized changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.