Security Alert Summary
The Media Library Assistant plugin for WordPress contains a missing capability check in a specific function, which allows authenticated users with Subscriber-level access and higher to modify taxonomy terms on attachments. This can result in unauthorized changes to media categorization or metadata. The CVE entry does not specify a patched version.
CVE Details
- CVE ID: CVE-2026-3072
- Affected plugin / component: Media Library Assistant plugin for WordPress
- Affected versions: All versions up to, and including, 3.33
- Published: March 5, 2026 at 6:16:52 AM UTC
- Last modified: March 5, 2026 at 6:16:52 AM UTC
- CVSS v3.1: Base score 4.3 — MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW
- User Interaction: NONE
- Scope: UNCHANGED
- Vector:
- Authentication / privileges: Authentication required — low privileges (authenticated users at Subscriber level and above, per the CVE description)
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-862
Technical Details
The vulnerability is caused by a missing capability check on the mla_update_compat_fields_action() function. Because the function lacks the necessary permission verification, authenticated users with Subscriber-level access or higher can invoke the action and modify taxonomy terms on arbitrary attachment records.
The CVE description specifically indicates the absence of a capability check as the root cause. The entry does not specify a patched or fixed version.
How This Could Impact Your Website
In a multi-user WordPress environment, this vulnerability could allow an authenticated low-privilege user — for example, a Subscriber or occasional contributor — to change taxonomy data on media items. Consider this realistic scenario:
- The site owner assigns different roles: internal staff (Editors), external contractors (Contributors), and general users (Subscribers).
- An authenticated Subscriber modifies taxonomy terms on attachment items (for example, tags or categories applied to images or documents).
- Those changes can alter how media is organized or presented on the site, potentially causing mislabeling, incorrect categorization, or unexpected media placement in galleries or feeds.
While the CVE indicates no direct confidentiality impact, altered taxonomy or metadata can indirectly aid social engineering by changing how media is contextualized or presented to users. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE entry does not specify a fixed version).
- Review and reduce unnecessary user roles and capabilities, especially for Contributors and Subscribers.
- Enforce strong passwords and enable two-factor authentication for Editors and Administrators.
- Remove unused or unmaintained plugins from your installation.
- Monitor site activity and media taxonomy changes for unusual behavior or unexpected edits.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.32/includes/class-mla-media-modal-ajax.php#L594
- https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.32/includes/class-mla-media-modal-ajax.php#L628
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3469795%40media-library-assistant%2Ftrunk&old=3465434%40media-library-assistant%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2655f936-8177-4836-a0b0-1c637290a3bc?source=cve
