Media Library Assistant, CVE-2026-3072

CVE, Research URL: CVE-2026-3072
Home page URL: Security reports for Media Library Assistant
Application: Media Library Assistant
Published on: Mar 05, 2026
Research Description: The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.
Affected versions: max 3.34.
Status: vulnerable