6.5
Moyenne
CVE-2026-113486 The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…
Description
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Media Library Assistant 3.42 | premières → < 3.42 | 3.42 |
Autres CVE de Media Library Assistant
Les 6 CVE de Media Library Assistant →
CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…
6.8
Moyenne
CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a…
4.3
Moyenne
CVE-2026-113485
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…
6.5
Moyenne
CVE-2026-16959
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it…
6.8
Moyenne