6.5
Moyenne
CVE-2026-113485 The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…
Description
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Media Library Assistant 3.42 | premières → < 3.42 | 3.42 |
Autres CVE de Media Library Assistant
Les 6 CVE de Media Library Assistant →
CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…
6.8
Moyenne
CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a…
4.3
Moyenne
CVE-2026-113486
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…
6.5
Moyenne
CVE-2026-16959
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it…
6.8
Moyenne