CVE-2026-3072 is a missing authorization vulnerability in the Media Library Assistant WordPress plugin by dglingren. The issue arises from the lack of a capability check in the mla_update_compat_fields_action() function, which enables authenticated users with minimal privileges (Subscriber-level and above) to modify taxonomy terms on attachments arbitrarily. This can lead to unauthorized data modification within the plugin's scope. The vulnerability affects all versions up to and including 3.33. The CVSS 3.1 score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and resulting in integrity impact only.

An attacker with Subscriber-level or higher access can modify taxonomy terms on arbitrary attachments, potentially affecting data integrity within the Media Library Assistant plugin. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and capabilities to trusted users only, and monitor for unauthorized changes to taxonomy terms. Avoid granting Subscriber-level or higher access to untrusted users.