CVE-2026-113485: Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF

Q: Who can be targeted by this issue?

An attacker would need to induce a logged-in WordPress user who has at least the Author role to submit a forged request. The impact is limited to attachment deletion or trashing through the Media Library bulk-action handler.

Q: What makes the CSRF protection bypass possible?

The affected handler checks the CSRF nonce only if the nonce field is included in the request. A forged request can omit that field and still trigger the bulk attachment action.

Q: Are installations running version 3.42 or later affected?

The issue affects Media Library Assistant versions before 3.42. The provided information does not indicate that version 3.42 or later is affected.

Published Oct 28, 2026

Updated

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.

Affected Software

1 affected component

wordpress/media-library-assistant<3.42

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can be targeted by this issue?

An attacker would need to induce a logged-in WordPress user who has at least the Author role to submit a forged request. The impact is limited to attachment deletion or trashing through the Media Library bulk-action handler.

What makes the CSRF protection bypass possible?

The affected handler checks the CSRF nonce only if the nonce field is included in the request. A forged request can omit that field and still trigger the bulk attachment action.

Are installations running version 3.42 or later affected?

The issue affects Media Library Assistant versions before 3.42. The provided information does not indicate that version 3.42 or later is affected.

CVE-2026-113485: Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF

Affected Software

Event History

Frequently Asked Questions

Who can be targeted by this issue?

What makes the CSRF protection bypass possible?

Are installations running version 3.42 or later affected?

Company

Resources

Contact

Frequently Asked Questions

Who can be targeted by this issue?

What makes the CSRF protection bypass possible?

Are installations running version 3.42 or later affected?