Live › vulnerability › CVE-2026-115594
Go to dashboardMedia Library Assistant, a WordPress plugin by David Lingren, sends sensitive information inside data it returns to the browser. An attacker can retrieve that embedded sensitive data, per the advisory text.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier. The sources do not say which settings or pages expose the data, so the exact exposure path is unknown. Sites that do not have the plugin installed can skip it.
No product ranges from the sources yet.
wp plugin get media-library-assistant --field=version3.423.42 once the vendor publishes a fixed release (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
This page as .md · .json · in your agent: get_signal("CVE-2026-115594")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.