Media LIbrary Assistant: Sensitive data exposure
Media LIbrary Assistant <= 3.42 includes sensitive information in data sent to a low-privilege authenticated requester. The CVSS vector assigns high confidentiality impact with no victim interaction, but the export does not disclose the endpoint, parameter, minimum WordPress role or the exact information exposed. The disclosure may provide material for a later attack, but the export does not identify credentials, files or a specific exploit chain.
- Component
- Media LIbrary Assistant
- Plugin slug
media-library-assistant- Affected
- <= 3.42
- Safe version
3.43- Published
- Oct 26, 2026
This CVE was published Oct 26, 2026 and is one of 50 known issues for this plugin.
Update, patch or deactivate.
Update Media LIbrary Assistant to 3.43 or later. Remove sensitive fields from responses unless the requester is authorized to receive them, and enforce object-level access checks before serializing data. Investigate what information the affected operation exposed; rotate secrets only where exposure is established.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N