CVE-2026-113481 — Vulnerability intelligence
—
Published:
- CVSS
- Not available
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.