CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
Unknown Media Library Assistant
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.42Media Library AssistantCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
Text from CVE List
Affected versions 1
- Media Library Assistantaffected: all versions before 3.42CVE List