CVE-2026-6075 describes a CSRF vulnerability in the Media Library Assistant plugin for WordPress (up to version 3.35). The issue arises because the plugin's bulk action handlers in the settings tab lack nonce verification, which is a security measure to validate legitimate requests. This flaw enables unauthenticated attackers to coerce an administrator into executing bulk operations such as deleting, editing, or purging plugin settings and attachment metadata through crafted requests without their consent.

Successful exploitation can lead to unauthorized bulk modification or deletion of plugin settings and attachment metadata, potentially disrupting site functionality or causing data loss. The vulnerability does not impact confidentiality but has high integrity and availability impacts as indicated by the CVSS vector (C:N/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted sites while logged into WordPress with administrative privileges. Monitoring vendor channels for updates is recommended.