CVE-2026-94297: Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with contributor-level access or higher can create terms because the plugin does not check the capability required to manage the target taxonomy.
What can an attacker change through this vulnerability?
They can create publicly visible terms in any taxonomy registered on the WordPress site. The available impact depends on which taxonomies the site has registered.
Are sites running the plugin affected by default?
The issue affects Media Library Organizer versions before 2.1.4 when contributor-level or higher accounts can authenticate to the site. Exploitation does not require the user to hold the target taxonomy's normal management capability.
What should be done if an update cannot be applied immediately?
Limit or remove contributor-level and other untrusted authenticated accounts until the plugin can be updated. Review registered taxonomies and newly created public terms for unauthorized additions.