{"id":"CVE-2026-113485","kind":"vulnerability","aliases":["CVE-2026-113485"],"related":[],"title":"Media Library Assistant WordPress plugin: forged requests can delete attachments","description":"The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.","summary":"The Media Library Assistant WordPress plugin before 3.42 checks its CSRF nonce on the Media Library bulk-action handler only when the nonce field is present. A forged request that leaves the field out can make a logged-in Author or higher user trash or delete media attachments.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-3.42-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get media-library-assistant --field=version`\n- Confirm the plugin is active with `wp plugin status media-library-assistant`","fix":"- Update the Media Library Assistant plugin to `3.42` or later\n- Until updated, limit Author-level and higher accounts to trusted users","status":"open","published_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:30+00:00","updated_at":"2026-10-28T06:32:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Media Library Assistant plugin to `3.42` or later\n- Until updated, limit Author-level and higher accounts to trusted users","reach":"internet","title":"Media Library Assistant WordPress plugin: forged requests can delete attachments","impact":"medium","summary":"The Media Library Assistant WordPress plugin before 3.42 checks its CSRF nonce on the Media Library bulk-action handler only when the nonce field is present. A forged request that leaves the field out can make a logged-in Author or higher user trash or delete media attachments.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","media-library"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attachments trashed or deleted by a forged request from a logged-in user","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get media-library-assistant --field=version`\n- Confirm the plugin is active with `wp plugin status media-library-assistant`","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.42-or-later"],"who_is_affected":"Sites running the Media Library Assistant plugin older than 3.42 where users with the Author role or above are logged in. Sites without the plugin, or with it at 3.42 or later, are not affected. The sources do not say whether the flaw is reachable without a logged-in session.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3314,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113485':13A,16A '-2026':12A,15A '3.42':32B,82C 'action':43B,96C 'assist':3A,28B,78C 'attach':10A,74B,132C 'author':66B,124C 'bulk':42B,95C 'bulk-act':41B,94C 'caus':116C 'check':33B,98C 'consist':85C 'csrf':35B,88C 'cve':11A,14A 'delet':9A,72B,131C 'field':49B,58B,104C,114C 'forg':6A,53B,109C 'handler':44B,97C 'higher':68B 'leav':56B 'librari':2A,19B,27B,40B,77C,93C 'log':64B,119C 'logged-in':63B,118C 'make':61B 'media':1A,18B,26B,39B,73B,76C,92C 'media-librari':17B 'nonc':36B,48B,89C,100C 'omit':112C 'packag':20B 'plugin':5A,24B,30B,80C 'present':51B,106C 'request':7A,54B,110C 'role':125C 'trash':70B,129C 'user':69B,121C 'valid':86C 'wordpress':4A,21B,23B,29B,79C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant plugin older than 3.42 where users with the Author role or above are logged in. Sites without the plugin, or with it at 3.42 or later, are not affected. The sources do not say whether the flaw is reachable without a logged-in session.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113485","severity":null,"published_at":"2026-10-28T06:16:34+00:00","modified_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}