Cross-Site Request Forgery Threat in Media Library Assistant Plugin by WordPress

CVE-2026-6075

What is CVE-2026-6075?

The Media Library Assistant plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability due to inadequate nonce verification on bulk action handlers in the settings tab. This deficiency permits unauthenticated attackers to craft malicious requests, potentially deceiving administrators into executing unintended bulk actions such as delete, edit, or purge on plugin settings and attachment metadata, jeopardizing the integrity and security of site data.

References