CVE-2026-113486: Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF

Q: Who can be targeted by this issue?

An attacker must cause a logged-in WordPress user with the Editor role or higher privileges to submit a forged request. The affected action can permanently delete all attachments that are currently in the media trash.

Q: Are attachments that are not in the trash affected?

The described action permanently deletes trashed attachments. The provided information does not indicate that active, non-trashed attachments are deleted by this issue.

Q: What versions need remediation?

Media Library Assistant versions before 3.42 are affected. Update to version 3.42 or later.

Published Oct 28, 2026

Updated

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.

Affected Software

1 affected component

Media Library Assistant Media Library Assistant<3.42

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can be targeted by this issue?

An attacker must cause a logged-in WordPress user with the Editor role or higher privileges to submit a forged request. The affected action can permanently delete all attachments that are currently in the media trash.

Are attachments that are not in the trash affected?

The described action permanently deletes trashed attachments. The provided information does not indicate that active, non-trashed attachments are deleted by this issue.

What versions need remediation?

Media Library Assistant versions before 3.42 are affected. Update to version 3.42 or later.

CVE-2026-113486: Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF

Affected Software

Event History

Frequently Asked Questions

Who can be targeted by this issue?

Are attachments that are not in the trash affected?

What versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can be targeted by this issue?

Are attachments that are not in the trash affected?

What versions need remediation?