The vulnerability identified as CVE-2026-49045 in the WP Media Adminimize plugin is categorized under CWE-862 (Missing Authorization). It arises from improper access control configurations that fail to enforce authorization checks correctly. This allows users with some level of privileges (PR:L) to perform actions without proper authorization, potentially leading to unauthorized access to certain plugin functionalities. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no user interaction required, and limited confidentiality impact.

The impact is limited to a confidentiality loss as per the CVSS vector, with no integrity or availability impact reported. Users with limited privileges may access or view information that should be restricted due to missing authorization checks. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, restrict plugin access to trusted users and review user privileges carefully to minimize risk.