{"id":"CVE-2026-113481","kind":"vulnerability","aliases":["CVE-2026-113481"],"related":[],"title":"WordPress Media Library Assistant: any logged-in user can read private taxonomy terms","description":"The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.","summary":"The Media Library Assistant WordPress plugin before 3.44 does not check whether a requesting user may view a post before revealing its taxonomy terms. Any authenticated user, including a subscriber, can learn the term assignments of private attachments and posts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library-assistant","package","self-hosted","wordpress"],"not_affected_if":["no-user-accounts","plugin-version-3.44-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/media-library-assistant/`.\n- Confirm whether any untrusted accounts (such as subscriber-level users) can log in to the site.","fix":"- Move the Media Library Assistant plugin to `3.44` or later.","status":"open","published_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","triaged_at":"2026-11-01T06:48:59+00:00","updated_at":"2026-11-01T06:48:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T06:48:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Media Library Assistant plugin to `3.44` or later.","reach":"internet","title":"WordPress Media Library Assistant: any logged-in user can read private taxonomy terms","impact":"low","summary":"The Media Library Assistant WordPress plugin before 3.44 does not check whether a requesting user may view a post before revealing its taxonomy terms. Any authenticated user, including a subscriber, can learn the term assignments of private attachments and posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","media-library-assistant","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read taxonomy terms of private posts","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/media-library-assistant/`.\n- Confirm whether any untrusted accounts (such as subscriber-level users) can log in to the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-3.44-or-later","no-user-accounts"],"who_is_affected":"Sites running the Media Library Assistant plugin before 3.44 that let people register or log in with any account. The exposure is information disclosure of taxonomy terms on private content, not code execution. Sites without this plugin, or running 3.44 or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":4112,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113481':17A,20A '-2026':16A,19A '3.44':37B,77C 'allow':86C,100C 'assign':64B,97C,112C 'assist':4A,24B,33B,73C 'attach':67B,115C 'authent':55B,102C 'check':40B,80C 'cve':15A,18A 'disclos':92C 'host':28B 'includ':57B 'learn':61B,109C 'librari':3A,23B,32B,72C 'log':7A 'logged-in':6A 'may':45B 'media':2A,22B,31B,71C 'media-library-assist':21B 'packag':25B 'plugin':35B,75C 'post':48B,69B,90C,117C 'privat':12A,66B,114C 'read':11A 'request':43B,83C 'reveal':50B 'self':27B 'self-host':26B 'subscrib':59B,107C 'taxonomi':13A,52B,94C 'term':14A,53B,63B,95C,111C 'user':9A,44B,56B,84C,103C 'view':46B,88C 'whether':41B 'wordpress':1A,29B,34B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant plugin before 3.44 that let people register or log in with any account. The exposure is information disclosure of taxonomy terms on private content, not code execution. Sites without this plugin, or running 3.44 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T05:18:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113481","severity":null,"published_at":"2026-11-01T05:18:57+00:00","modified_at":"2026-11-01T05:18:57+00:00","first_seen_at":"2026-11-01T06:48:24+00:00","fetched_at":"2026-11-01T06:48:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}