{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-113481","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","state":"PUBLISHED","assignerShortName":"WPScan","dateReserved":"2026-10-20T08:46:29.329Z","datePublished":"2026-11-01T06:00:22.682Z","dateUpdated":"2026-11-01T06:00:22.682Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan","dateUpdated":"2026-11-01T06:00:22.682Z"},"title":"Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields","problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"affected":[{"vendor":"Unknown","product":"Media Library Assistant","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"3.44"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts."}],"references":[{"url":"https://wpscan.com/vulnerability/7b11d80d-1e90-4437-b5a5-483e8fd345d7/","tags":["exploit","vdb-entry","technical-description"]}],"credits":[{"lang":"en","value":"Karthik Ramakrishnan","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}}}}