CVE-2023-4634

What it actually does

CVE-2023-4634 is an unauthenticated path-control flaw in the Media Library Assistant plugin for WordPress, affecting versions up to and including 3.09. The vulnerable image streaming code in `includes/mla-stream-image.php` accepts attacker-controlled input through the `mla_stream_file` parameter and passes the referenced file into Imagick processing without sufficient path validation. An attacker can abuse this to reference unintended local or remotely supplied files, enabling directory listing, local file inclusion, sensitive file disclosure, and, depending on ImageMagick/Imagick delegate behavior and server configuration, remote code execution.

Why it matters to the business

A successful compromise can expose WordPress configuration secrets, database credentials, private media, and other server-side files, and may allow an attacker to execute code on the web server. Because the flaw is unauthenticated, network-exploitable, high-severity, and has a high EPSS score with weaponized exploit maturity, exposed sites using affected plugin versions should be treated as high-priority remediation targets. Operational consequences can include website defacement, malware or web shell deployment, credential theft, spam or phishing infrastructure abuse, data breach, and downtime.

How an attack unfolds

An attacker first identifies a WordPress site running a vulnerable Media Library Assistant plugin version. They then send a crafted request directly to the plugin’s image streaming endpoint and supply a malicious or unauthorized path through the `mla_stream_file` parameter. For file disclosure, the supplied path may attempt traversal or use a stream/wrapper-style reference to cause the application to read files outside the intended media library scope. For code execution, the attacker may cause Imagick to process a crafted file supplied from an attacker-controlled location, such as over FTP, or otherwise abuse ImageMagick delegate handling to trigger unintended behavior. If successful, the attacker can retrieve sensitive local files or place/execute attacker-controlled code, commonly followed by persistence through a PHP web shell, credential harvesting from WordPress configuration, and lateral movement using recovered credentials.

How to fix it

Upgrade the Media Library Assistant plugin to a version newer than 3.09 that contains the vendor fix. If a fixed version is not available through normal package management, disable and remove the plugin until a fixed release can be installed. Restrict direct web access to plugin helper scripts that should not be externally reachable, especially `/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php`, using web server or WAF rules. Block suspicious uses of `mla_stream_file`, including path traversal sequences, PHP stream wrappers, and remote URL schemes. Harden ImageMagick/Imagick by disabling dangerous coders and delegates where not required, restricting remote file fetching, and applying current ImageMagick security policy recommendations. Rotate WordPress database credentials and other secrets if exploitation is suspected, because local file disclosure may have exposed configuration files.

How to confirm the fix worked

Confirm the installed Media Library Assistant plugin version is greater than 3.09 or that the plugin has been disabled/removed. Verify that direct unauthenticated requests to `/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php` are denied or no longer process attacker-controlled `mla_stream_file` values. Review the patched code or vendor changelog to ensure strict path validation, allowlisting, and safe image processing are in place. Test WAF or web server controls with benign requests containing `mla_stream_file`, traversal sequences, and remote URL schemes to ensure they are blocked or rejected. Validate ImageMagick policy hardening by confirming unused remote/delegate coders are disabled. After remediation, review web logs to ensure exploitation attempts receive 403/404 or other safe failures rather than 200 responses or application errors.

Typical attack path

1. Scan for WordPress sites exposing the Media Library Assistant plugin or its `mla-stream-image.php` endpoint.
2. Determine that the installed plugin version is 3.09 or earlier, or directly test for vulnerable behavior.
3. Send unauthenticated requests to `includes/mla-stream-image.php` using the `mla_stream_file` parameter with crafted local, traversal, wrapper, or remote file references.
4. Use local file inclusion or directory listing behavior to read sensitive files such as WordPress configuration, server files, or application source.
5. If feasible, provide a crafted image/vector file through an attacker-controlled location and cause Imagick to process it in a way that enables command execution or file write behavior.
6. Deploy or invoke a web shell, modify site content, create persistence, steal credentials, or use the compromised server for follow-on activity.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, WAF logs, reverse proxy logs, PHP error logs, WordPress debug logs, FTP logs, outbound network telemetry, endpoint process telemetry, and file integrity monitoring data. Look for unauthenticated requests to `/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php`, especially those containing `mla_stream_file`, directory traversal sequences, encoded traversal, local file paths, stream wrappers, or remote URL schemes such as FTP. Correlate such requests with unusual 200 responses, 500 errors, ImageMagick/Imagick errors, or outbound FTP connections from the web server. Examine filesystem changes around the time of suspicious requests, especially new or modified PHP files under WordPress upload, theme, plugin, cache, or webroot directories. Investigate PHP or web server worker processes spawning shell utilities, interpreters, network tools, or outbound connections. Check for access to sensitive files such as WordPress configuration, SSH keys, environment files, or system password files. Review WordPress user accounts and audit logs for unexpected administrator creation, plugin/theme editor usage, or unauthorized content changes after the first suspicious request.

• /wp-content/plugins/media-library-assistant/includes/mla-stream-image.php
• mla-stream-image.php
• mla_stream_file=
• mla_stream_file=../
• mla_stream_file=..%2f
• mla_stream_file=%2e%2e%2f
• mla_stream_file=/etc/passwd
• mla_stream_file=../../../../wp-config.php
• mla_stream_file=php://
• mla_stream_file=file://
• mla_stream_file=ftp://
• mla_stream_file=http://
• mla_stream_file=https://
• ImagickException
• not authorized `
• delegate failed
• no decode delegate for this image format
• MSL:
• MVG:
• /wp-content/uploads/*.php
• /wp-content/uploads/*/*.php
• /wp-content/plugins/media-library-assistant/*.php
• /wp-content/plugins/media-library-assistant/includes/*.php

What your security team should do

• Immediately inventory WordPress sites for the Media Library Assistant plugin and prioritize any installation running version 3.09 or earlier.
• Upgrade to a fixed version if available; otherwise disable and remove the plugin until a fixed release is deployed.
• Add temporary WAF/web server rules blocking direct access to `mla-stream-image.php` and requests containing suspicious `mla_stream_file` values.
• Review web access logs for historical requests to the vulnerable endpoint, especially because exploit maturity is weaponized and EPSS indicates high likelihood of exploitation.
• Inspect affected servers for web shells, unexpected PHP files, modified plugin/theme files, unauthorized WordPress administrator accounts, and outbound FTP or unusual network connections.
• If evidence of exploitation exists, rotate WordPress database credentials, application secrets, administrator passwords, and any credentials stored on the host.
• Harden ImageMagick/Imagick policy to disable unnecessary coders, delegates, and remote fetch behavior.
• Place vulnerable WordPress applications behind a WAF or reverse proxy with virtual patching while remediation is underway.