CVE-2026-113485
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present. A forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
Risk Assessment
An attacker can trick a user with sufficient privileges into performing a request that trashes or deletes attachments without their knowledge.
Recommendation
Update the Media Library Assistant plugin to version 3.42 or later.
Other vulnerabilities in Media Library Assistant WordPress plugin
See all- CVE-2026-113482Medium
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- CVE-2026-113481Medium
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
- CVE-2026-113486Medium
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action. A forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
- CVE-2025-11738Medium
The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information.
Original NVD description (English source)
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS