CVE-2026-3072
Unauthorized Data Modification in Media Library Assistant Plugin
Publication date: 2026-03-05
Last updated on: 2026-03-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| media_library_assistant | media_library_assistant | to 3.33 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Media Library Assistant plugin for WordPress has a vulnerability due to a missing capability check in the mla_update_compat_fields_action() function in all versions up to and including 3.33. This flaw allows authenticated users with Subscriber-level access or higher to modify taxonomy terms on arbitrary media attachments without proper authorization.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing low-privileged authenticated users (Subscribers and above) to alter taxonomy terms on media attachments. This unauthorized modification can lead to data integrity issues, misclassification of media files, and potential disruption of media management workflows within your WordPress site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves unauthorized modification of taxonomy terms via AJAX requests in the Media Library Assistant WordPress plugin. Detection would involve monitoring AJAX requests to the WordPress site, specifically those targeting the mla_update_compat_fields_action() function or related AJAX endpoints.'}, {'type': 'paragraph', 'content': 'Since the vulnerability allows authenticated users with Subscriber-level access and above to modify taxonomy terms without proper capability checks, detection can focus on unusual or unauthorized AJAX POST requests that modify attachment taxonomies.'}, {'type': 'paragraph', 'content': 'Suggested commands or methods to detect this vulnerability include:'}, {'type': 'list_item', 'content': 'Review web server access logs for POST requests to admin-ajax.php with parameters related to mla_update_compat_fields_action or similar.'}, {'type': 'list_item', 'content': "Use tools like grep or awk to filter logs for suspicious AJAX calls, for example: `grep 'admin-ajax.php' /var/log/apache2/access.log | grep 'mla_update_compat_fields_action'`."}, {'type': 'list_item', 'content': 'Check WordPress user roles and recent changes to taxonomy terms on attachments to identify unauthorized modifications.'}, {'type': 'list_item', 'content': 'Implement WordPress audit logging plugins to track taxonomy term changes and AJAX requests.'}, {'type': 'paragraph', 'content': 'Note that the plugin update (version 3.33) added permission and nonce checks to AJAX handlers to mitigate this issue, so verifying the plugin version installed can also help detect vulnerability presence.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation step is to update the Media Library Assistant WordPress plugin to version 3.33 or later, where security enhancements have been implemented.'}, {'type': 'paragraph', 'content': 'The update includes:'}, {'type': 'list_item', 'content': "Adding capability checks (`current_user_can('edit_post', $post_id)`) before processing AJAX requests to ensure only authorized users can modify taxonomy terms."}, {'type': 'list_item', 'content': 'Enforcing nonce verification (`check_ajax_referer()`) to protect against CSRF attacks on AJAX endpoints.'}, {'type': 'paragraph', 'content': 'Additional steps include:'}, {'type': 'list_item', 'content': 'Restricting user roles and permissions to limit who can access media taxonomy editing features.'}, {'type': 'list_item', 'content': 'Monitoring and auditing AJAX requests and taxonomy term changes for suspicious activity.'}, {'type': 'list_item', 'content': 'If immediate update is not possible, consider disabling the plugin temporarily or restricting access to the AJAX endpoints via web server rules.'}] [2]