Live › vulnerability › CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check whether a requesting user may view a post before revealing its taxonomy terms. Any authenticated user, including a subscriber, can learn the term assignments of private attachments and posts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 06:48 UTC. All times on this page are UTC.
Sites running the Media Library Assistant plugin before 3.44 that let people register or log in with any account. The exposure is information disclosure of taxonomy terms on private content, not code execution. Sites without this plugin, or running 3.44 or later, can skip it.
No product ranges from the sources yet.
wp-content/plugins/media-library-assistant/.3.44 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
This page as .md · .json · in your agent: get_signal("CVE-2026-113481")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.