Medium severity · published Nov 1, 2026
CVE-2026-113481
Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields
New
4.3
CVSS
–
EPSS
No
On KEV
Description
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Media Library Assistant ·
before 3.44 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113481
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113481
exploit
https://wpscan.com/vulnerability/7b11d80d-1e90-4437-b5a5-483e8fd345d7/
More from Media Library Assistant
7.2
CVE-2023-0279
Media Library Assistant < 3.06 - Admin+ SQLi
6.8
CVE-2026-113482
Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
6.8
CVE-2026-16959
Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
6.5
CVE-2026-113486
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
6.5
CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF