CVE-2026-115594: WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Media Library Assistantto a version that resolves this vulnerability.Fixed in 3.43
Event History
Frequently Asked Questions
Which deployments are affected?
Media Library Assistant installations running any affected version through 3.42 are in scope. The available data does not identify a first affected version.
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation is network-accessible, requires low attack complexity, and does not require user interaction.
What is the potential impact?
Successful exploitation may expose sensitive information embedded in data sent by the plugin. The provided CVSS vector rates confidentiality impact as high, with no integrity or availability impact.