Cross-Site Request Forgery Vulnerability in Media Library Assistant Plugin from WordPress
CVE-2026-113485
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-113485?
The Media Library Assistant plugin for WordPress contains a security flaw that compromises CSRF nonce validation in its bulk-action handler. This vulnerability allows attackers to send forged requests that may bypass the nonce check when the nonce field is omitted. As a result, authenticated users with the Author role or higher may inadvertently trash or delete attachments, potentially leading to loss of important media files.
Affected Version(s)
Media Library Assistant 0 < 3.42
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.