Concerns About Security Risk Warning for Media Library Assistant (v3.33)

Resolved mediapool
(@mediapool)

5 months, 2 weeks ago
Wordfence-Scan found a critical issue:
- The Plugin “Media Library Assistant” has a security vulnerability.Type: Plugin Vulnerable
- Issue Found 6. March 2026 7:38Critical
- Plugin Name: Media Library Assistant
- Current Plugin Version: 3.33
- Details: To protect your site from this vulnerability, the safest option is to deactivate and completely remove “Media Library Assistant” until a patched version is available. Get more information.(opens in new tab)
- Repository URL: https://wordpress.org/plugins/media-library-assistant(opens in new tab)
- Vulnerability Information: https://www.wordfence.com/threat-intel/vulnerabilities/id/2655f936-8177-4836-a0b0-1c637290a3bc?source=plugin(opens in new tab)
- Vulnerability Severity: 4.3/10.0 (Medium)

Viewing 6 replies - 1 through 6 (of 6 total)

Studio Pence
(@bpence)

5 months, 2 weeks ago

Oddly, PatchStack shows an update is available, but not showing up here. What’s being done about this?

https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-33-missing-authorization-to-authenticated-subscriber-arbitrary-attachment-taxonomy-modification-vulnerability

Plugin Author David Lingren
(@dglingren)

5 months, 2 weeks ago

Thank you both for your reports. The vulnerability in question allows a logged in user to write JavaScript code that modifies taxonomy terms assigned to a Media Library item. It’s listed as “Medium” in Wordfence and “Low priority – No impactful threat” in Patchstack. I’m not sure why Wordfence-Scan shows it as “Critical”.

I will be updating MLA to version 3.34 later today, which should resolve the issue. I will post an update here after the release is completed.

crzyhrse
(@crzyhrse)

5 months, 2 weeks ago

Came to say the same:

Media Library Assistant <= 3.33 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

Description
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.

Plugin Author David Lingren
(@dglingren)

5 months, 2 weeks ago

I have updated MLA to version 3.34, which resolves this issue. I am marking this topic resolved, but please update it or start a new topic if you have any problems with the new version. Thanks for your patience and your interest in the plugin.

Thread Starter mediapool
(@mediapool)

5 months, 2 weeks ago

Thank you for your fast answer and problem solving!

crzyhrse
(@crzyhrse)

5 months, 2 weeks ago

Also Thank You David…! 🙏🏽

Viewing 6 replies - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.