{"id":"CVE-2026-115594","kind":"vulnerability","aliases":["CVE-2026-115594"],"related":[],"title":"Media Library Assistant WordPress plugin leaks embedded sensitive data in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.","summary":"Media Library Assistant, a WordPress plugin by David Lingren, sends sensitive information inside data it returns to the browser. An attacker can retrieve that embedded sensitive data, per the advisory text.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library-assistant","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Media Library Assistant plugin (media-library-assistant) in the WordPress admin plugin list, or with `wp plugin get media-library-assistant --field=version`\n- Compare the installed version against the affected range, which ends at `3.42`","fix":"- Update Media Library Assistant to a version later than `3.42` once the vendor publishes a fixed release (unknown from the sources)\n- Until then, unknown; deactivate the plugin if it is not needed","status":"open","published_at":"2026-10-26T11:16:34+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:08+00:00","updated_at":"2026-10-26T11:31:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T11:31:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update Media Library Assistant to a version later than `3.42` once the vendor publishes a fixed release (unknown from the sources)\n- Until then, unknown; deactivate the plugin if it is not needed","reach":"unknown","title":"Media Library Assistant WordPress plugin leaks embedded sensitive data in responses","impact":"medium","summary":"Media Library Assistant, a WordPress plugin by David Lingren, sends sensitive information inside data it returns to the browser. An attacker can retrieve that embedded sensitive data, per the advisory text.","category":"package","nicknames":[],"who_cares":["wordpress","media-library-assistant"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive data embedded in responses can be retrieved by an attacker","analyst_note":"Find the fixed version and the exact sensitive data exposed in the NVD entry and the plugin's changelog or the Wordfence/Patchstack record.","how_to_check":"- Check the installed version of the Media Library Assistant plugin (media-library-assistant) in the WordPress admin plugin list, or with `wp plugin get media-library-assistant --field=version`\n- Compare the installed version against the affected range, which ends at `3.42`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier. The sources do not say which settings or pages expose the data, so the exact exposure path is unknown. Sites that do not have the plugin installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000628,"input_tokens":3316,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115594':14A,17A '-2026':13A,16A '3.42':86C 'advisori':53B 'affect':79C 'allow':73C 'assist':3A,21B,26B,68C,72C,82C 'attack':44B 'browser':42B 'cve':12A,15A 'data':9A,37B,50B,61C 'data.this':77C 'david':31B,64C 'embed':7A,48B,75C 'inform':35B,58C 'insert':55C 'insid':36B 'issu':78C 'leak':6A 'librari':2A,20B,25B,67C,71C,81C 'lingren':32B,65C 'media':1A,19B,24B,66C,70C,80C 'media-library-assist':18B,69C 'n/a':84C 'packag':22B 'per':51B 'plugin':5A,29B 'respons':11A 'retriev':46B,74C 'return':39B 'send':33B 'sensit':8A,34B,49B,57C,76C 'sent':60C 'text':54B 'vulner':62C 'wordpress':4A,23B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier. The sources do not say which settings or pages expose the data, so the exact exposure path is unknown. Sites that do not have the plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115594","severity":null,"published_at":"2026-10-26T11:16:34+00:00","modified_at":"2026-10-26T11:16:34+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}