The vulnerability in David Lingren's Media LIbrary Assistant plugin permits the insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data. This data exposure can compromise confidentiality by leaking private or personal information that was inadvertently included in media metadata or other hidden fields. The weakness is classified as CWE-201, indicating that the application mishandles sensitive information during transmission. Because the plugin propagates this data in responses, any user capable of triggering the vulnerable function could gain unauthorized access to private content saved by the site owner.

The affected product is the Media LIbrary Assistant WordPress plugin from vendor David Lingren, in all versions up to and including 3.42. Users running any of these versions should update to at least 3.43, where the issue is addressed, or otherwise remove the vulnerable plugin.

The CVSS score of 6.5 marks the flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation activity is uncertain. The likely attack vector is through the WordPress site itself, where an attacker—either external or a compromised user—could invoke the plugin’s data retrieval endpoints to capture sensitive information. No explicit prerequisites are detailed in the description, so it can be inferred that the plugin’s poorly protected API or output rendering allows exposure to anyone who can trigger the function, potentially without administrative privileges.