Cross-Site Request Forgery in Media Library Assistant Plugin for WordPress
CVE-2026-113486
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-113486?
The Media Library Assistant plugin for WordPress versions prior to 3.42 is vulnerable to cross-site request forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious request that, if executed by a logged-in user with Editor privileges or higher, can lead to the permanent deletion of all trashed attachments on the site. The plugin does not properly verify the CSRF nonce during the Empty Trash action, enabling unauthorized media deletion.
Affected Version(s)
Media Library Assistant 0 < 3.42
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.