CVE-2026-6075

HIGH 8.1

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.

CWE	CWE-352
Vendor	dglingren
Product	media library assistant
Published	May 29, 2026
Last Updated	May 29, 2026

Stay Ahead of the Next One

Get instant alerts for dglingren media library assistant

Be the first to know when new high vulnerabilities affecting dglingren media library assistant are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

dglingren / Media Library Assistant

0 ≤ 3.35

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce199b47a?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings.php#L1331 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings-view-tab.php#L224 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings-view-tab.php#L224 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings-custom-fields-tab.php#L664 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings-custom-fields-tab.php#L664 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings-iptc-exif-tab.php#L804 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings-iptc-exif-tab.php#L804 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings.php#L1331 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3494141/media-library-assistant/trunk/includes/class-mla-settings-custom-fields-tab.php plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?old_path=%2Fmedia-library-assistant/tags/3.34&new_path=%2Fmedia-library-assistant/tags/3.35

Credits

Jack Pas