Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
Summary
| CVE | CVE-2026-6075 |
|---|---|
| State | PUBLISHED |
| Assigner | Wordfence |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-29 09:16:18 UTC |
| Updated | 2026-05-29 13:09:05 UTC |
| Description | The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request. |
Risk And Classification
Primary CVSS: v3.1 8.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
EPSS: 0.000430000 probability, percentile 0.134890000 (date 2026-05-29)
Problem Types: CWE-352 | CWE-352 CWE-352 Cross-Site Request Forgery (CSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
| 3.1 | CNA | DECLARED | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Dglingren | Media Library Assistant | affected 3.35 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-sett... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-... | [email protected] | plugins.trac.wordpress.org | |
| www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce... | [email protected] | www.wordfence.com | |
| plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-sett... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-sett... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-sett... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/changeset/3494141/media-library-assistant/trunk/includes/clas... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-... | [email protected] | plugins.trac.wordpress.org | |
| plugins.trac.wordpress.org/changeset | [email protected] | plugins.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jack Pas (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-10T14:46:34.000Z | Vendor Notified |
| CNA | 2026-05-28T18:57:53.000Z | Disclosed |
There are currently no legacy QID mappings associated with this CVE.