What is the CVSS score of CVE-2026-6075?

CVE-2026-6075 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Media Library Assistant are affected by CVE-2026-6075?

The Media Library Assistant WordPress plugin (versions 3.35 and earlier) contains a CSRF vulnerability allowing attackers to trick authenticated administrators into executing destructive bulk…

How to fix or mitigate CVE-2026-6075?

Within 24 hours: Audit all WordPress installations to identify Media Library Assistant plugin presence and version numbers; inventory any instances running version 3.35 or earlier. Within 7 days: Implement network controls restricting /wp-admin access to trusted IP ranges; disable the plugin if not operationally critical; enforce multi-factor authentication on all administrative accounts. Within 30 days: Subscribe to vendor security advisories for an available patch; evaluate alternative media management solutions; deploy vendor patch immediately upon release.

Media Library Assistant CVE-2026-6075

EUVD-2026-33258 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-29 Wordfence

GHSA-j3vq-mvrg-4qxf

WordPress CSRF Media Library Assistant

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 09:15 vuln.today

CVE Published

May 29, 2026 - 07:46 nvd

HIGH 8.1

DescriptionCVE.org

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.

AnalysisAI

Cross-Site Request Forgery in the Media Library Assistant WordPress plugin versions 3.35 and earlier allows remote attackers to coerce authenticated administrators into executing bulk delete, edit, or purge actions against plugin settings and attachment metadata. The flaw stems from missing nonce checks on bulk action handlers across multiple settings tabs and was reported by Wordfence. There is no public exploit identified at time of analysis and no CISA KEV listing, but the high CVSS of 8.1 reflects significant integrity and availability impact if a logged-in admin is lured to a malicious page.

Technical ContextAI

Media Library Assistant (vendor 'dglingren', CPE cpe:2.3:a:dglingren:media_library_assistant) is a popular WordPress plugin that extends the native media library with bulk editing, custom field mapping, IPTC/EXIF processing, and view/taxonomy management. The root cause is CWE-352 (Cross-Site Request Forgery): the bulk action handlers in class-mla-settings.php (line ~1331), class-mla-settings-view-tab.php (~L224), class-mla-settings-custom-fields-tab.php (~L664), and class-mla-settings-iptc-exif-tab.php (~L804) accept POST submissions without validating a WordPress nonce (wp_verify_nonce / check_admin_referer). Because WordPress relies on browser-attached session cookies for admin authentication, any state-changing endpoint that omits a nonce can be triggered cross-origin by an attacker-controlled page that an authenticated administrator visits.

RemediationAI

Upstream fix available in plugin trac changeset 3494141 and the 3.34→3.35 diff (https://plugins.trac.wordpress.org/changeset?old_path=%2Fmedia-library-assistant/tags/3.34&new_path=%2Fmedia-library-assistant/tags/3.35); however, the description states versions 'up to, and including, 3.35' are vulnerable, so a released patched version is not independently confirmed and administrators should monitor the plugin page and Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce199b47a) for a confirmed fixed release greater than 3.35 and upgrade as soon as it ships. Until a confirmed patched version is available, restrict /wp-admin access to known IPs via web server ACLs or a WAF, require administrators to log out of the WordPress dashboard before browsing untrusted sites, and consider temporarily deactivating Media Library Assistant if its bulk settings/IPTC/EXIF/custom-fields workflows are not in active use - the trade-off is loss of advanced media management features. WAF rules that enforce Referer/Origin checks on wp-admin POSTs to the plugin's settings tabs are a useful compensating control but may break legitimate cross-subdomain admin workflows.