{"id":"CVE-2026-113486","kind":"vulnerability","aliases":["CVE-2026-113486"],"related":[],"title":"WordPress Media Library Assistant: forged request empties media trash","description":"The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.","summary":"The Media Library Assistant plugin for WordPress before 3.42 skips a CSRF nonce check on its Empty Trash media action. A forged cross-site request can make a logged-in Editor or higher permanently delete every trashed attachment on the site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-library-assistant","package","self-hosted","wordpress"],"not_affected_if":["no-editor-accounts","plugin-updated-to-3.42"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get media-library-assistant --field=version`\n- Confirm the version is below `3.42`","fix":"- Update the Media Library Assistant plugin to `3.42` or later\n- Restore trashed attachments from backup if they were deleted without intent","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:29+00:00","updated_at":"2026-10-28T06:32:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Media Library Assistant plugin to `3.42` or later\n- Restore trashed attachments from backup if they were deleted without intent","reach":"internet","title":"WordPress Media Library Assistant: forged request empties media trash","impact":"medium","summary":"The Media Library Assistant plugin for WordPress before 3.42 skips a CSRF nonce check on its Empty Trash media action. A forged cross-site request can make a logged-in Editor or higher permanently delete every trashed attachment on the site.","category":"package","nicknames":[],"who_cares":["wordpress","media-library-assistant","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Every trashed attachment on the site is permanently deleted","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get media-library-assistant --field=version`\n- Confirm the version is below `3.42`","needs_analyst":false,"not_affected_if":["plugin-updated-to-3.42","no-editor-accounts"],"who_is_affected":"Sites running the Media Library Assistant plugin before version 3.42 that have logged-in users with the Editor role or above. An attacker needs a logged-in editor to visit a malicious page, so sites with no editor accounts or with the plugin already updated can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3304,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113486':12A,15A '-2026':11A,14A '3.42':33B,75C 'action':44B,87C 'assist':4A,19B,28B,71C 'attach':64B,113C 'caus':96C 'check':38B 'cross':48B,92C 'cross-sit':47B,91C 'csrf':36B,80C 'cve':10A,13A 'delet':61B,110C 'editor':57B,104C 'empti':7A,41B,84C 'everi':62B,111C 'forg':5A,46B,90C 'higher':59B 'host':23B 'librari':3A,18B,27B,70C 'log':55B,99C 'logged-in':54B,98C 'make':52B 'media':2A,8A,17B,26B,43B,69C,86C 'media-library-assist':16B 'nonc':37B,81C 'packag':20B 'perman':60B,109C 'plugin':29B,73C 'request':6A,50B,94C 'role':105C 'self':22B 'self-host':21B 'site':49B,67B,93C,116C 'skip':34B 'trash':9A,42B,63B,85C,112C 'user':101C 'verifi':78C 'wordpress':1A,24B,31B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant plugin before version 3.42 that have logged-in users with the Editor role or above. An attacker needs a logged-in editor to visit a malicious page, so sites with no editor accounts or with the plugin already updated can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113486","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}