4.3
Medium
CVE-2026-113481 The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a…
Description
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Media Library Assistant 3.44 | earliest → < 3.44 | 3.44 |
Other CVEs of Media Library Assistant
The 6 CVEs of Media Library Assistant →
CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…
6.8
Medium
CVE-2026-113486
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…
6.5
Medium
CVE-2026-113485
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…
6.5
Medium
CVE-2026-16959
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it…
6.8
Medium