Media Library Assistant CVE-2026-113481

Requires an authenticated WordPress account of any role, including a subscriber - the description explicitly states 'any authenticated user, such as a subscriber.' The Media Library Assistant plugin (version before 3.44) omits the check that the requesting user is permitted to view a post before returning that object's assigned taxonomy terms, so the condition is simply having a valid low-privilege session against a site running the vulnerable plugin. Limiting factors: exploitation is not possible unauthenticated (PR:L), the account must exist (relevant where registration is open or on multi-user sites), and only taxonomy term assignments of private posts/attachments are exposed - not the post content, media files, or other sensitive data - bounding impact to confidentiality (C:L, I:N, A:N).

This is a low-severity information-disclosure flaw (CVSS 4.3) whose real-world priority is modest. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity issue that requires an authenticated account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The intelligence signals are consistent and point the same direction: EPSS is very low (0.13%, 3rd percentile), the CVE is NOT on CISA KEV, and SSVC records Exploitation=none, Automatable=no, Technical Impact=partial. The vuln.today decision label is 'this_month' - a routine patch cadence rather than an emergency. The only mildly elevating factor is that a PoC reference exists via WPScan, but it is not verified as working exploit code, so it does not by itself raise urgency. Net: this is a genuine but low-priority authorization gap, not a high-CVSS-but-overstated issue - the CVSS is already low and every other signal agrees. No signals conflict; the main caveat is that what leaks is taxonomy term metadata of private posts/attachments, not the post contents themselves, which further bounds the practical impact.

An attacker who holds any low-privilege WordPress account (for example a self-registered subscriber on a site allowing open registration) sends a request to the Media Library Assistant endpoint referencing a private post or attachment and receives the taxonomy terms assigned to it, despite not being authorized to view that object. A PoC reference published by WPScan exists but is not verified as working exploit code. Given AV:N/AC:L, the request is straightforward once a valid session is obtained, though only term-assignment metadata is exposed.