CVE-2026-113485 | BDVDB-2026-397176 Detail

Description#

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-28Record published in the CVE List.