CVE-2026-6075CWE-352

Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

High · published May 29, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
23.8
In the wild
Unconfirmed
What it is

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-05-29T07:46Z
EPSS history
Timeline
  • 29 MAY 07:46Z
    Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form
    cvelistv5