Is CVE-2026-6075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6075 being exploited in the wild.

How severe is CVE-2026-6075?

High severity, with a CVSS score of 8.1, published 29 May 2026.

Which products and versions are affected?

David Lingren Media Library Assistant up to, and including, 3.35.

Is there a fix for CVE-2026-6075?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6075 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6075?

Check whether you run David Lingren Media Library Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6075: Media Library Assistant CSRF in settings bulk action handlers

CVE-2026-6075 · Severity: high · CVSS 8.1 · Published 2026-05-29

The Media Library Assistant plugin for WordPress, which helps manage website media files and metadata, is vulnerable to an attack that can trick administrators into performing unintended actions. By convincing a logged-in administrator to click a malicious link, an attacker can remotely delete, edit, or purge plugin settings and media attachment data. This could lead to significant data loss or disruption of the website's media management capabilities.

Technologies: David Lingren Media Library Assistant. Vendors: David Lingren.

Quick answers

Is CVE-2026-6075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6075 being exploited in the wild.
How severe is CVE-2026-6075?: High severity, with a CVSS score of 8.1, published 29 May 2026.
Which products and versions are affected?: David Lingren Media Library Assistant up to, and including, 3.35.
Is there a fix for CVE-2026-6075?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6075 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6075?: Check whether you run David Lingren Media Library Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 3.35. The vulnerability is caused by missing nonce verification within the bulk action handlers located in the settings tab handlers (specifically within class-mla-settings.php and associated tab classes). An unauthenticated attacker can exploit this by crafting a malicious request and tricking a site administrator into executing it via social engineering. Successful exploitation allows the attacker to perform bulk delete, edit, or purge operations on plugin settings and attachment metadata. A patch appears to be available in versions following 3.35.

Affected products

David Lingren Media Library Assistant up to, and including, 3.35

Timeline

2026-05-29: disclosed: Initial publication of the CVE record.
2026-05-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.