{"id":"CVE-2026-113481","state":"PUBLISHED","title":"Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields","description":"The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.","publishedAt":"2026-11-01T06:00:22.682Z","updatedAt":"2026-11-01T06:00:22.682Z","severity":null,"assigner":"WPScan","products":["Unknown Media Library Assistant"],"affected":[{"vendor":"Unknown","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.44","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/7b11d80d-1e90-4437-b5a5-483e8fd345d7/"],"weaknesses":[],"ingestedAt":"2026-11-01T06:04:06.026Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/113xxx/CVE-2026-113481.json","commit":"18d8b38848bf014dc50886d799aa620431d1af0f","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-113481","state":"PUBLISHED","datePublished":"2026-11-01T06:00:22.682Z","dateUpdated":"2026-11-01T06:00:22.682Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-10-20T08:46:29.329Z"},"containers":{"cna":{"title":"Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields","descriptions":[{"lang":"en","value":"The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts."}],"affected":[{"vendor":"Unknown","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.44","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7b11d80d-1e90-4437-b5a5-483e8fd345d7/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-11-01T06:00:22.682Z"},"credits":[{"lang":"en","value":"Karthik Ramakrishnan","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}}