CVE-2026-6075: Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form

Synopsis

A cross-site request forgery vulnerability in the Media Library Assistant WordPress plugin (versions 3.35 and earlier) lets a remote attacker forge requests that target an authenticated administrator. The bulk action handlers in the settings tab skip nonce verification, so an admin who visits an attacker-controlled page while logged in can be made to delete, edit, or purge plugin settings and attachment metadata without consent. Successful exploitation tampers with site configuration and stored media records and can disrupt the media library, and HarborGuard tracks the advisory for patch availability since no fixed version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker needs to deliver a forged request that reaches the WordPress admin over the network, typically by luring the administrator to a hostile page.

• AuthenticationNot required

  The attacker themselves does not authenticate; the forged request rides on the victim administrator's existing session.

• Victim interactionRequired

  An authenticated administrator must visit or interact with attacker-controlled content while logged into the WordPress site.

• Attack complexityDetail

  Attack complexity is low: the missing nonce check makes the forged bulk action reliable without race conditions or environmental tuning.

Blast Radius

• Modifies persisted Media Library Assistant plugin settings on the WordPress site.
• Deletes, edits, or purges attachment metadata records in the media library.
• Disrupts availability of the media library and any site features that depend on those attachments or plugin configuration.