CVE-2026-77824

Name of the Vulnerable Software and Affected Versions Media Sweep – WordPress Media Cleaner versions prior to 1.1.4

Description An issue exists where authenticated attackers with administrator-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the user-supplied fields parameter and a lack of sufficient preparation on the existing SQL query, allowing the addition of malicious SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 1.1.3. Avoid using the fields parameter until the update is applied.