CVE-2026-3072: Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mlaupdatecompatfieldsaction() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3072?
CVE-2026-3072 is considered a high severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2026-3072?
To fix CVE-2026-3072, update the Media Library Assistant plugin to a version above 3.33 which implements proper capability checks.
Who is affected by CVE-2026-3072?
CVE-2026-3072 affects users of the Media Library Assistant plugin for WordPress version 3.33 and below.
What type of vulnerability is CVE-2026-3072?
CVE-2026-3072 is an authorization vulnerability allowing unauthorized users to modify attachment taxonomy.
Can CVE-2026-3072 be exploited remotely?
Yes, CVE-2026-3072 can be exploited remotely by authenticated users with subscriber-level access.