Media Library Assistant EUVD-2026-109728

Exploitation requires an authenticated account with at least low privileges (PR:L) on a WordPress site running Media Library Assistant version 3.42 or earlier; no user interaction is needed and the request is network-reachable (AV:N/AC:L/UI:N). The precise feature, endpoint, or configuration that triggers the sensitive-data exposure is not described in the available sources - the advisory states only that sensitive information is inserted into sent data (CWE-201), allowing retrieval of embedded sensitive data. The limiting factors are the authentication requirement (unauthenticated visitors cannot exploit it) and the confidentiality-only impact (no write or denial-of-service effect).

This is a moderate-severity information disclosure flaw (CVSS 6.5) in the Media Library Assistant WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation that requires some level of authenticated privilege (PR:L), with impact confined to confidentiality (C:H) and no effect on integrity or availability. The signals are consistent rather than conflicting: a CWE-201 'Insertion of Sensitive Information Into Sent Data' weakness aligns with a confidentiality-only impact and no active-exploitation indicators. No CISA KEV listing and no EPSS score were provided, so there is no evidence of active or widespread exploitation; the only reference is the Patchstack/EUVD advisory, not working exploit code. The vuln.today decision label is 'this_month', which is a routine-patch priority rather than an emergency. Overall this is a legitimate but non-urgent issue: real because it exposes sensitive data to a low-privileged authenticated user, but not a drop-everything priority given the authentication requirement, confidentiality-only impact, and absence of KEV/EPSS/exploit signals.

A low-privileged authenticated user of a WordPress site running Media Library Assistant (through version 3.42) sends a request to the plugin that returns or embeds sensitive data they should not be able to see. Because the attack vector is network-based with low complexity and no user interaction, the actor only needs valid low-level credentials to retrieve the exposed information. No public exploit code was identified at the time of analysis.