The Media Library Assistant plugin contains a Cross‑Site Request Forgery vulnerability that allows a malicious website to send forged requests to the plugin’s administrative endpoints. Because the vulnerability relies on the victim’s authenticated session, an attacker could perform arbitrary actions such as moving or deleting media items under the victim’s account. The weakness is a classic CSRF flaw (CWE‑352).

The vulnerability affects the WordPress Media Library Assistant plugin developed by David Lingren. All released versions up to and including 3.42 are susceptible. WordPress installations that have any of those plugin versions are impacted.

The score of 4.3 on the CVSS scale indicates a moderate risk. No EPSS data is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation. The vector is likely from a malicious page that the victim visits while authenticated with the site; thus the threat requires the user to be logged in and the site to accept the forged request.