{"id":"CVE-2026-97295","kind":"vulnerability","aliases":["CVE-2026-97295"],"related":[],"title":"Media Library Assistant WordPress plugin: CSRF lets forged requests act as admin","description":"Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.","summary":"The Media Library Assistant WordPress plugin by David Lingren has a cross-site request forgery flaw in versions through 3.42. An attacker can trick a logged-in administrator's browser into sending a request the plugin accepts, and the sources do not say which actions that request can perform.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get media-library-assistant --field=version`\n- Confirm whether the version is `3.42` or lower\n- Check the actions the plugin exposes: unknown","fix":"- Update media-library-assistant to a version later than `3.42` once the vendor publishes one; the sources do not name a fixed version\n- Until then, deactivate the plugin if it is not needed","status":"open","published_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:31:03+00:00","updated_at":"2026-10-26T10:31:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T10:31:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update media-library-assistant to a version later than `3.42` once the vendor publishes one; the sources do not name a fixed version\n- Until then, deactivate the plugin if it is not needed","reach":"internet","title":"Media Library Assistant WordPress plugin: CSRF lets forged requests act as admin","impact":"medium","summary":"The Media Library Assistant WordPress plugin by David Lingren has a cross-site request forgery flaw in versions through 3.42. An attacker can trick a logged-in administrator's browser into sending a request the plugin accepts, and the sources do not say which actions that request can perform.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; attacker forges requests in a victim's logged-in browser session","analyst_note":"Check the NVD entry and the plugin's changelog or WordPress.org page for the fixed version and the specific forged actions.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get media-library-assistant --field=version`\n- Confirm whether the version is `3.42` or lower\n- Check the actions the plugin exposes: unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier are exposed. Sites without the plugin installed can skip it. The sources do not say whether exploitation requires an authenticated administrator session, so exposure on logged-in admin sessions is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3316,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97295':15A,18A '3.42':44B,105C 'accept':62B 'act':10A 'action':70B 'admin':12A 'administr':53B 'affect':98C 'allow':92C 'assist':3A,27B,87C,91C,101C 'attack':46B 'browser':55B 'cross':36B,76C,93C 'cross-sit':35B,75C 'csrf':6A,80C 'cve':13A,16A 'david':31B,83C 'flaw':40B 'forg':8A 'forgeri':39B,79C 'forgery.this':96C 'host':22B 'issu':97C 'let':7A 'librari':2A,26B,86C,90C,100C 'lingren':32B,84C 'log':51B 'logged-in':50B 'media':1A,25B,85C,89C,99C 'media-library-assist':88C 'n/a':103C 'packag':19B 'perform':74B 'plugin':5A,29B,61B 'request':9A,38B,59B,72B,78C,95C 'say':68B 'self':21B 'self-host':20B 'send':57B 'site':37B,77C,94C 'sourc':65B 'trick':48B 'version':42B 'vulner':81C 'wordpress':4A,23B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Media Library Assistant WordPress plugin at version 3.42 or earlier are exposed. Sites without the plugin installed can skip it. The sources do not say whether exploitation requires an authenticated administrator session, so exposure on logged-in admin sessions is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97295","severity":null,"published_at":"2026-10-26T10:16:53+00:00","modified_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}