The Media Library Assistant plugin for WordPress is vulnerable to Cross‑Site Request Forgery in all versions up to and including 3.35 because bulk action handlers in the settings tab do not perform nonce verification. An attacker who can trick an administrative user into visiting a crafted URL can cause the server to execute a bulk delete, edit or purge operation on plugin settings and attachment metadata, potentially destroying configuration and media data. The flaw is a straightforward CSRF weakness (CWE‑352) and does not require any additional permissions beyond those of the logged‑in administrator.

All installations of the dglingren Media Library Assistant WordPress plugin with a version of 3.35 or earlier are affected. The vulnerability applies to the bulk action handlers in the settings tab of the plugin.

The vulnerability receives a CVSS score of 8.1, indicating high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires only that an attacker be able to coerce a logged‑in administrator into visiting a malicious URL; no privileged access or vulnerability exploitation on the server is needed. The straightforward CSRF attack path and high impact of unauthorized bulk changes make this a significant risk to affected sites.