{"affected":[],"cveId":"CVE-2026-113481","cwes":["CWE-862"],"description":"The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793557028490,"publishedAt":1793510337110,"references":[{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/7b11d80d-1e90-4437-b5a5-483e8fd345d7/"}],"remediation":[],"revision":"1a2fec27428d627d03fb2e4be4b9eb7bbbcc69ef180180d46f2104ad478969ba","sources":[{"modifiedAt":1793557028490,"name":"NVD","retrievedAt":1793578561074,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113481"}],"ssvc":{"assessedAt":1793553973473,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2026-113481","updatedAt":1793578561074}