EUVD-2026-33258
GHSA-j3vq-mvrg-4qxf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Media Library Assistant ≤3.35
-
DeliveryCraft malicious page with auto-submitting form targeting bulk-action endpoint
-
ExploitLure authenticated administrator to the page (phishing/social)
-
ExecutionBrowser submits forged POST with admin session cookie
-
PersistPlugin executes bulk delete/edit/purge without nonce check
-
ImpactAttachment metadata and plugin settings destroyed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target WordPress site to run Media Library Assistant version 3.35 or earlier with the plugin active, (2) a user with administrator privileges to be authenticated to /wp-admin with a valid session cookie, and (3) that administrator to be tricked into visiting an attacker-controlled page or clicking an attacker-crafted link in the same browser session (CVSS UI:R). The vulnerable endpoints are specifically the bulk action handlers in the Settings → View, Custom Fields, and IPTC/EXIF tabs and class-mla-settings.php; non-admin users cannot trigger destructive bulk operations even if lured. Limiting factors: same-site cookies, browsers' SameSite=Lax default for new session cookies, WordPress login session timeouts, and admin-only WAF/IP restrictions all reduce real-world exploitability. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H captures the realistic profile: network-reachable, low complexity, no attacker privileges, but requiring user interaction (the admin must visit a malicious page while logged in) and yielding high integrity and availability impact with no confidentiality loss - consistent with a destructive bulk-delete/edit primitive rather than data exfiltration. The vulnerability is not listed in CISA KEV and no public exploit is identified at time of analysis; EPSS data was not provided. SSVC-style assessment: exploitation status appears 'none', the attack is partially automatable (a one-click drive-by works against any logged-in admin), and technical impact is partial (limited to plugin settings and attachment metadata, not full site takeover). Net assessment: a real but conditional risk - high score is justified by destructive potential, but UI:R and the niche of bulk-action endpoints lower the realistic urgency compared to authentication-bypass or RCE bugs in popular plugins. |
| Exploit ScenarioDerived | An attacker hosts a page containing a hidden auto-submitting form (or image/fetch tag) targeting one of the unprotected bulk-action endpoints in Media Library Assistant's settings tabs. They send the URL to a site administrator via phishing email, forum DM, or a comment on a site the admin frequents; when the logged-in admin opens the page, the browser attaches the WordPress session cookie and the forged POST executes a bulk delete or purge of attachment metadata or plugin settings, causing irreversible content loss. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Cross-Site Request Forgery in the Media Library Assistant WordPress plugin versions 3.35 and earlier allows remote attackers to coerce authenticated administrators into executing bulk delete, edit, or purge actions against plugin settings and attachment metadata. The flaw stems from missing nonce checks on bulk action handlers across multiple settings tabs and was reported by Wordfence. There is no public exploit identified at time of analysis and no CISA KEV listing, but the high CVSS of 8.1 reflects significant integrity and availability impact if a logged-in admin is lured to a malicious page.
RemediationAI
Upstream fix available in plugin trac changeset 3494141 and the 3.34→3.35 diff (https://plugins.trac.wordpress.org/changeset?old_path=%2Fmedia-library-assistant/tags/3.34&new_path=%2Fmedia-library-assistant/tags/3.35); however, the description states versions 'up to, and including, 3.35' are vulnerable, so a released patched version is not independently confirmed and administrators should monitor the plugin page and Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce199b47a) for a confirmed fixed release greater than 3.35 and upgrade as soon as it ships. Until a confirmed patched version is available, restrict /wp-admin access to known IPs via web server ACLs or a WAF, require administrators to log out of the WordPress dashboard before browsing untrusted sites, and consider temporarily deactivating Media Library Assistant if its bulk settings/IPTC/EXIF/custom-fields workflows are not in active use - the trade-off is loss of advanced media management features. WAF rules that enforce Referer/Origin checks on wp-admin POSTs to the plugin's settings tabs are a useful compensating control but may break legitimate cross-subdomain admin workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Media Library Assistant (vendor 'dglingren', CPE cpe:2.3:a:dglingren:media_library_assistant) is a popular WordPress plugin that extends the native media library with bulk editing, custom field mapping, IPTC/EXIF processing, and view/taxonomy management. The root cause is CWE-352 (Cross-Site Request Forgery): the bulk action handlers in class-mla-settings.php (line ~1331), class-mla-settings-view-tab.php (~L224), class-mla-settings-custom-fields-tab.php (~L664), and class-mla-settings-iptc-exif-tab.php (~L804) accept POST submissions without validating a WordPress nonce (wp_verify_nonce / check_admin_referer). Because WordPress relies on browser-attached session cookies for admin authentication, any state-changing endpoint that omits a nonce can be triggered cross-origin by an attacker-controlled page that an authenticated administrator visits.
Know when Media Library Assistant gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request.
Executive ViewAI
The Media Library Assistant WordPress plugin (versions 3.35 and earlier) contains a CSRF vulnerability allowing attackers to trick authenticated administrators into executing destructive bulk actions-deletion, modification, and purging of media assets and plugin settings. Any organization running this plugin faces data integrity and availability risk if administrators are socially engineered to visit attacker-controlled pages. Urgent remediation is required as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict WordPress administrative access by IP address; (2) Deploy Web Application Firewall rules to detect and block CSRF attack vectors targeting /wp-admin; (3) Enforce multi-factor authentication on all admin accounts; (4) Disable the plugin entirely if non-critical to operations; (5) Enable comprehensive audit logging and alerting on bulk media/attachment actions; (6) Conduct security awareness training on CSRF and targeted phishing attacks against administrators; (7) Implement network segmentation to limit lateral movement from compromised admin accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Media Library Assistant
View allThe Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in vers
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_ga
SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Au
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingre
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all ver
The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter wit
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type valida
Blind SQL injection in Media Library Assistant through version 3.32 allows authenticated attackers to execute arbitrary
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contrib
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using
Exploit-DB