---
id: "CVE-2026-119491"
page: "https://infrastack.ai/live/CVE-2026-119491"
kind: "vulnerability"
aliases: ["CVE-2026-119491"]
title: "WordPress Media Library Assistant: missing authorization check lets users bypass access controls"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["media-library-assistant", "runtime", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T10:17:08+00:00"
first_seen_at: "2026-11-07T10:46:40+00:00"
updated_at: "2026-11-07T10:48:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119491", "first_seen_at": "2026-11-07T10:46:40+00:00"}]
exploit_sources: []
---

# WordPress Media Library Assistant: missing authorization check lets users bypass access controls

Link for people: https://infrastack.ai/live/CVE-2026-119491 (this .md is for agents)

The Media Library Assistant WordPress plugin by David Lingren has a missing authorization check, so access control settings are not enforced as intended. Per the description, versions through 3.43 are affected, and an attacker may reach media or data they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or look for the `media-library-assistant` plugin header in `wp-content/plugins/media-library-assistant/`
- Compare the installed version against 3.43, which the description lists as affected through

## Timeline

- 2026-11-07T10:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119491

## From the sources

Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_