CVE-2026-3072: 
WordPress vulnerability analysis and mitigation

CVE-2026-3072 is a Missing Authorization vulnerability in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.33. Due to a missing capability check on the mla_update_compat_fields_action() function, authenticated attackers with Subscriber-level access or above can modify taxonomy terms on arbitrary attachments without proper authorization. The vulnerability was disclosed on March 5, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, RedHat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The vulnerable function mla_update_compat_fields_action() in class-mla-media-modal-ajax.php (lines 594 and 628) does not perform a capability check before processing requests, allowing any authenticated user — regardless of their role — to invoke it over the network. An attacker with a low-privilege WordPress account (e.g., Subscriber) can send a crafted AJAX request to this function to modify taxonomy terms on any media attachment in the WordPress media library. The patch was introduced in the plugin changeset moving from version 3.33 to 3.34 (Wordfence, WP Plugin Trac).

Successful exploitation allows authenticated low-privilege users to modify taxonomy terms (e.g., categories, tags, custom taxonomies) on any media attachment in the WordPress site's media library, constituting an unauthorized data integrity violation. There is no confidentiality or availability impact — the vulnerability is limited to unauthorized data modification. While the direct impact is limited, manipulation of media metadata could disrupt content organization, SEO, or media management workflows on affected WordPress sites (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability requires authentication (at minimum Subscriber-level), which limits the attack surface compared to unauthenticated vulnerabilities. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify WordPress sites running the Media Library Assistant plugin at version 3.33 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain low-privilege account: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious AJAX request: Authenticate to the WordPress site and send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the mla_update_compat_fields_action() function, including parameters specifying the target attachment ID and desired taxonomy term modifications.
4. Modify taxonomy terms: Because no capability check is performed, the server processes the request and updates taxonomy terms on the specified media attachment, regardless of whether the attacker has legitimate permissions to do so (Wordfence, WP Plugin Trac).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with an action parameter corresponding to mla_update_compat_fields_action from low-privilege user accounts (Subscriber role).
• Logs: WordPress database logs or audit plugin logs showing unexpected taxonomy term changes on media attachments, particularly from accounts that do not normally manage media.
• Application: Unexpected or unauthorized changes to taxonomy terms (categories, tags, custom taxonomies) on media library attachments, especially in bulk or across unrelated attachments.

Users should update the Media Library Assistant plugin to version 3.34 or later, which introduces the missing capability check in the mla_update_compat_fields_action() function. The fix is available via the official WordPress plugin repository. As a temporary workaround, site administrators can restrict Subscriber-level user registration or disable the plugin until the update can be applied. Reviewing and auditing media attachment taxonomy terms for unauthorized changes is also recommended (WP Plugin Trac, Wordfence).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry covering the technical details and patch information. Sucuri included this vulnerability in their March 2026 vulnerability patch roundup, indicating it received standard coverage in the WordPress security community (Sucuri Blog, Wordfence). No significant broader media coverage or notable researcher commentary beyond routine vulnerability disclosure was identified.