medium6.5
CVE-2026-113486
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause…
Impact
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
Affected products
| Product | Affected versions |
|---|---|
| Media Library Assistant WordPress Plugin | before 3.42 |
Versions were read from the advisory text. No structured product data has been published for this record yet.