PT-2026-127840
CVE-2026-113485
·
Published
2026-10-28
·
Updated
2026-10-28
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾