The vulnerability in Media Library Assistant allows any authenticated user, such as a subscriber, to retrieve the taxonomy terms assigned to private posts or attachments. This missing authorization check permits the disclosure of hidden classification data, which can be leveraged to map content categories or glean sensitive organizational structure. The weakness is an information‑exposure flaw that does not provide code execution or RCE capabilities.

WordPress installations using the Media Library Assistant plugin with a version earlier than 3.44 are affected. The issue applies to all user roles that have basic authentication access, including Subscribers.

Since the flaw only exposes taxonomy metadata, the indirect impact is limited to information disclosure. No remote code execution or privilege escalation is directly possible. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating current exploitation activity is not known. An attacker would need to authenticate with a valid WordPress account and invoke the plugin’s endpoint, which makes the attack vector internal and requires legitimate user credentials.