CVE-2026-113486 in Media Library Assistant Plugin
Summary
by MITRE • 10/28/2026
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Media Library Assistant versions prior to 3.42 represents a critical failure in server-side state change validation, specifically concerning Cross-Site Request Forgery protections. This flaw is rooted in the absence of CSRF nonce verification for the Empty Trash media action within the plugin's administrative interface. In modern web application security architecture, particularly for content management systems like WordPress that rely heavily on user-generated content and complex permission hierarchies, state-changing operations must be protected against unauthorized execution via maliciously crafted requests from third-party sites. The specific technical flaw lies in the backend handler for this action not checking a unique, secret token associated with the current user session before proceeding with data modification commands. This omission allows an attacker to construct a forged request that mimics legitimate administrative activity without requiring any form of authentication or interaction beyond the victim visiting a malicious page containing the exploit payload.
From a technical perspective, this vulnerability aligns directly with CWE-352, which defines Cross-Site Request Forgery as a flaw where a web application accepts requests from untrusted sources without verifying that they were intentionally initiated by the user. The operational impact of this deficiency is severe due to the specific privileges required and the destructive nature of the action involved. An attacker only needs to lure a logged-in WordPress administrator or editor, who possesses at least Editor-level permissions, to visit a malicious website or view a compromised page containing an automated request targeting the vulnerable endpoint. Once triggered, the browser will automatically include any existing session cookies for the target site in the HTTP request, effectively authenticating the forged action as if it originated from the victim's own dashboard. Consequently, this results in the permanent deletion of all media items currently residing in the trash bin across the entire WordPress installation.
The consequences extend beyond simple data loss; they impact business continuity and operational integrity. The destruction of trashed attachments means that any images, documents, or other files scheduled for eventual removal are irrevocably erased if backups are not immediately available. This can lead to significant downtime while content is restored from backup systems, potentially causing reputational damage and financial loss depending on the criticality of the media assets hosted by the organization. Furthermore, because the attack requires no user interaction beyond page load or a simple click, it falls under high-exploitability categories in threat modeling frameworks such as MITRE ATT&CK, specifically relating to techniques that abuse trusted relationships within an application environment. Attackers can leverage this vulnerability in conjunction with social engineering tactics to maximize success rates against targets who may not be aware of the security implications of visiting untrusted web content while logged into their administrative accounts.
To mitigate this risk and restore secure operational standards, immediate remediation is required by upgrading the Media Library Assistant plugin to version 3.42 or later, where the developers have implemented proper nonce verification mechanisms for all state-changing operations. In environments where patching cannot occur instantly due to compatibility testing requirements, temporary mitigations should be enforced through web application firewalls that can detect and block requests lacking valid CSRF tokens or exhibiting patterns consistent with forged submissions. Additionally, organizations should enforce strict session management policies, such as shorter timeout durations for administrative sessions, to reduce the window of opportunity for exploitation. Regular security audits focusing on input validation and state change integrity are essential to prevent similar vulnerabilities in other plugins or custom code within the WordPress ecosystem, ensuring that all actions modifying data adhere to established industry standards like CWE-352 and maintain robust defense-in-depth strategies against cross-site request forgery attacks.