The Media Library Assistant plugin contains a missing authorization flaw that allows attackers to exploit incorrectly configured access control settings, enabling them to perform actions they would normally be prohibited from doing. This broken access control can lead to unauthorized viewing or modification of media assets stored in a WordPress site. The weakness is a classic example of inadequate authorization checks, matching CWE‑862. The description indicates that any user—depending on the site’s role configuration—could bypass restrictions, possibly leading to data exposure or integrity compromise.

WordPress sites using the Media Library Assistant plugin up to version 3.43 are affected. All releases from any version before the fix through 3.43 are vulnerable, regardless of other installed plugins or WordPress core updates. Site administrators should identify any instance of the plugin within this version range.

The CVSS score of 4.3 suggests moderate base severity, but lack of an EPSS score means exploitation prevalence is unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is remote via the web interface, where an unauthenticated or minimally privileged user can send crafted requests to the plugin’s endpoint. Because the flaw relies on incorrect ACL configuration, the attacker may succeed only if role permissions are misassigned; however, standard misconfigurations are common in many installations.