Junglewise Threat Intelligence

CVE-2026-6075: Media Library Assistant CSRF in settings bulk action handlers

CVE-2026-6075 · Severity: high · CVSS 8.1 · Published 2026-05-29

Technologies: David Lingren Media Library Assistant. Vendors: David Lingren.

Executive brief

The Media Library Assistant plugin for WordPress, which helps manage website media files and metadata, is vulnerable to an attack that can trick administrators into performing unintended actions. By convincing a logged-in administrator to click a malicious link, an attacker can remotely delete, edit, or purge plugin settings and media attachment data. This could lead to significant data loss or disruption of the website's media management capabilities.

Technical details

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 3.35. The vulnerability is caused by missing nonce verification within the bulk action handlers located in the settings tab handlers (specifically within class-mla-settings.php and associated tab classes). An unauthenticated attacker can exploit this by crafting a malicious request and tricking a site administrator into executing it via social engineering. Successful exploitation allows the attacker to perform bulk delete, edit, or purge operations on plugin settings and attachment metadata. A patch appears to be available in versions following 3.35.

Affected products

  • David Lingren Media Library Assistant up to, and including, 3.35

Timeline

  • 2026-05-29: disclosed: Initial publication of the CVE record.
  • 2026-05-29: advisory

References

Related threats