Unscored severity · published Oct 28, 2026
CVE-2026-113486
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
New
–
CVSS
–
EPSS
No
On KEV
Description
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Media Library Assistant ·
before 3.42 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113486
exploit
https://wpscan.com/vulnerability/29f5c90d-564a-4844-bf8e-b72243da5a0a/
More from Media Library Assistant
6.8
CVE-2026-16959
Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
–
CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF