Live › vulnerability › CVE-2026-113485
Go to dashboardThe Media Library Assistant WordPress plugin before 3.42 checks its CSRF nonce on the Media Library bulk-action handler only when the nonce field is present. A forged request that leaves the field out can make a logged-in Author or higher user trash or delete media attachments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Media Library Assistant plugin older than 3.42 where users with the Author role or above are logged in. Sites without the plugin, or with it at 3.42 or later, are not affected. The sources do not say whether the flaw is reachable without a logged-in session.
No product ranges from the sources yet.
wp plugin get media-library-assistant --field=versionwp plugin status media-library-assistant3.42 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
This page as .md · .json · in your agent: get_signal("CVE-2026-113485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.