Unscored severity · published Oct 28, 2026
CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
New
–
CVSS
–
EPSS
No
On KEV
Description
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Media Library Assistant ·
before 3.42 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113485
exploit
https://wpscan.com/vulnerability/d2705c60-8d84-4e96-89df-628cdc814058/
More from Media Library Assistant
6.8
CVE-2026-16959
Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
–
CVE-2026-113486
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF