Vulnerability record/PUBLISHED/Published Nov 1, 2026 06:00:22 UTC
CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 1, 2026 06:00:22 UTC
PublishedNov 1, 2026 06:00:22 UTC
ReservedOct 20, 2026 08:46:29 UTC
Credits
- Karthik Ramakrishnan
- WPScan