CVE-2026-113481

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.44

Description An issue exists where the plugin fails to verify if the requesting user has the necessary permissions to view a post before disclosing its assigned taxonomy terms. This occurs due to a missing capability check in a function, allowing any authenticated user, including those with subscriber-level access, to discover term assignments for private posts and attachments.

Recommendations Update to version 3.44 or later.