The Media Library Assistant plugin for WordPress allows an authenticated user with Subscriber-level access and above to modify taxonomy terms on any attachment due to a missing capability check in the mla_update_compat_fields_action() function. This flaw enables attackers to change how media items are categorized or tagged, potentially undermining site organization, media searchability, and the integrity of content metadata. The weakness is classified as an Authorization Bypass (CWE-862).

dglingren:Media Library Assistant – the WordPress Media Library Assistant plugin. All released versions up to and including 3.33 are affected. Users running any of those versions must verify their installation and apply a fix or upgrade.

The reported CVSS v3 score of 4.3 reflects moderate impact with an authenticated attack vector. The EPSS score is less than 1%, indicating a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the flaw requires only a standard subscriber account, the risk is chiefly that legitimate users could unintentionally or maliciously alter media taxonomy, but it does not provide a path to remote code execution or system compromise.