Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/7b11d80d-1e90-4437-b5a5-483e8fd345d7 İstismar kodu ya da analiz

Kayıt geçmişi

1. 1 Kas 2026 20:40CVSS puanı değişti: – → 4.3
2. 1 Kas 2026 09:00Yayımlandı

İlgili açıklar

• 6,8 CVE-2026-113482Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
• 6,5 CVE-2026-113485Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
• 6,5 CVE-2026-113486Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
• 4,3 CVE-2026-107343Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
• 6,5 CVE-2026-103997Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…
• 4,3 CVE-2025-11455Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement