{"id":"CVE-2026-119491","kind":"vulnerability","aliases":["CVE-2026-119491"],"related":[],"title":"WordPress Media Library Assistant: missing authorization check lets users bypass access controls","description":"Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43.","summary":"The Media Library Assistant WordPress plugin by David Lingren has a missing authorization check, so access control settings are not enforced as intended. Per the description, versions through 3.43 are affected, and an attacker may reach media or data they should not see.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library-assistant","runtime","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `media-library-assistant` plugin header in `wp-content/plugins/media-library-assistant/`\n- Compare the installed version against 3.43, which the description lists as affected through","fix":null,"status":"open","published_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:54+00:00","updated_at":"2026-11-07T10:48:54+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-07T10:48:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Media Library Assistant: missing authorization check lets users bypass access controls","impact":"medium","summary":"The Media Library Assistant WordPress plugin by David Lingren has a missing authorization check, so access control settings are not enforced as intended. Per the description, versions through 3.43 are affected, and an attacker may reach media or data they should not see.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","media-library-assistant"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users read or change media library content they should not access","analyst_note":"Confirm the affected version range, the fixed version and the exact access control behavior from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `media-library-assistant` plugin header in `wp-content/plugins/media-library-assistant/`\n- Compare the installed version against 3.43, which the description lists as affected through","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Media Library Assistant WordPress plugin at or below version 3.43 are the ones the description names. Sites without this plugin, or running a later version, are not affected. The sources do not say which roles or settings make the access control weakness reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4216,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119491':15A,18A '-2026':14A,17A '3.43':53B,97C 'access':11A,40B,85C 'affect':55B,90C 'allow':81C 'assist':4A,22B,28B,76C,80C,93C 'attack':58B 'author':6A,37B,69C 'bypass':10A 'check':7A,38B 'configur':84C 'control':12A,41B,86C 'cve':13A,16A 'data':63B 'david':32B,72C 'descript':50B 'enforc':45B 'exploit':82C 'incorrect':83C 'intend':47B 'issu':89C 'let':8A 'levels.this':88C 'librari':3A,21B,27B,75C,79C,92C 'lingren':33B,73C 'may':59B 'media':2A,20B,26B,61B,74C,78C,91C 'media-library-assist':19B,77C 'miss':5A,36B,68C 'n/a':95C 'per':48B 'plugin':30B 'reach':60B 'runtim':23B 'secur':87C 'see':67B 'set':42B 'user':9A 'version':51B 'vulner':70C 'wordpress':1A,24B,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant WordPress plugin at or below version 3.43 are the ones the description names. Sites without this plugin, or running a later version, are not affected. The sources do not say which roles or settings make the access control weakness reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medialibraryassistant","medium","runtime","wordpress"],"campaign_type":null,"search_a":"'-119491':15A,18A '-2026':14A,17A 'access':11A 'assist':4A 'author':6A 'bypass':10A 'check':7A 'control':12A 'cve':13A,16A 'let':8A 'librari':3A 'media':2A 'miss':5A 'user':9A 'wordpress':1A","search_b":"'3.43':53B 'access':40B 'affect':55B 'assist':22B,28B 'attack':58B 'author':37B 'check':38B 'control':41B 'data':63B 'david':32B 'descript':50B 'enforc':45B 'intend':47B 'librari':21B,27B 'lingren':33B 'may':59B 'media':20B,26B,61B 'media-library-assist':19B 'miss':36B 'per':48B 'plugin':30B 'reach':60B 'runtim':23B 'see':67B 'set':42B 'version':51B 'wordpress':24B,29B","search_c":"'3.43':97C 'access':85C 'affect':90C 'allow':81C 'assist':76C,80C,93C 'author':69C 'configur':84C 'control':86C 'david':72C 'exploit':82C 'incorrect':83C 'issu':89C 'levels.this':88C 'librari':75C,79C,92C 'lingren':73C 'media':74C,78C,91C 'media-library-assist':77C 'miss':68C 'n/a':95C 'secur':87C 'vulner':70C","first_public_at":"2026-11-07T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119491","severity":null,"published_at":"2026-11-07T10:17:08+00:00","modified_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}