CVE-2023-4634

CRITICAL EXPLOITED NUCLEI LAB

Media Library Assistant <3.09 - RCE

Title source: llm

Exploitation Summary

CVE-2023-4634 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Florent MONTEL, Patrowl, Evillm. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated remote file inclusion (LFI) and potential remote code execution (RCE) in the Media Library Assistant WordPress plugin (< 3.10) via Imagick SVG conversion. It leverages a malicious SVG file hosted on an FTP server to trigger file disclosure or RCE depending on Imagick configuration.

Description

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.

Exploits (3)

exploitdb WORKING POC

by Florent MONTEL · textwebappsphp

https://www.exploit-db.com/exploits/51737

View Code ZIP pw:eip

This exploit demonstrates an unauthenticated remote file inclusion (LFI) and potential remote code execution (RCE) in the Media Library Assistant WordPress plugin (< 3.10) via Imagick SVG conversion. It leverages a malicious SVG file hosted on an FTP server to trigger file disclosure or RCE depending on Imagick configuration.

Classification

Working Poc 90%

Attack Type

Rce | Lfi

Complexity

Moderate

Reliability

Reliable

Target: Media Library Assistant WordPress Plugin < 3.10

No auth needed

Prerequisites: FTP server hosting malicious SVG files · Imagick installed on target with permissive policy.xml

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 46 stars

by Patrowl · remote

https://github.com/Patrowl/CVE-2023-4634

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2023-4634, targeting an unauthenticated RCE vulnerability in the Media-Library-Assistant WordPress plugin (versions < 3.10). The exploit leverages SVG/MSL polyglot files and PNG/PHP polyglot generation to achieve remote code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Media-Library-Assistant WordPress plugin < 3.10

No auth needed

Prerequisites: Target URL · Remote FTP/HTTP server for file storage · Web server path on victim · PHP payload

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

nomisec WORKING POC

by Evillm · poc

https://github.com/Evillm/CVE-2023-4634-PoC

View Code ZIP pw:eip

This repository contains a functional exploit PoC for CVE-2023-4634, targeting the WordPress Media Library Assistant plugin < 3.10. It includes a Dockerized vulnerable environment and a scanner that confirms RCE via a pre-placed web shell.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: WordPress Media Library Assistant plugin < 3.10

No auth needed

Prerequisites: Docker · Python 3.7+ · Target running vulnerable WordPress plugin

MITRE ATT&CK