blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-6075

HIGH 8.1 CVSS 3.1
Published
May 29, 2026
Last modified
July 21, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Description

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • dglingren Media Library Assistant — Up to and including 3.35

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings-custom-fields-tab.php#L664
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings-iptc-exif-tab.php#L804
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings-view-tab.php#L224
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.33/includes/class-mla-settings.php#L1331
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings-custom-fields-tab.php#L664
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings-iptc-exif-tab.php#L804
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings-view-tab.php#L224
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings.php#L1331
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3494141/media-library-assistant/trunk/includes/class-mla-settings-custom-fields-tab.php
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?old_path=%2Fmedia-library-assistant/tags/3.34&new_path=%2Fmedia-library-assistant/tags/3.35
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce199b47a?source=cve
  • nvd.nist.gov Official NVD record