CVE-2026-113486 | BDVDB-2026-397177 Detail

Description#

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-28Record published in the CVE List.