{"id":"CVE-2026-113485","aliases":[],"title":"Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"Media Library Assistant","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.42","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-113485"}],"remediation":[],"description":"The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.","severity":"unknown","score":null,"published":"2026-10-28T06:00:25.578Z","modified":"2026-10-28T17:58:05.466Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/d2705c60-8d84-4e96-89df-628cdc814058/"],"sources":[{"name":"CVE","id":"CVE-2026-113485","modified":"2026-10-28T17:58:05.466Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-113485"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:20:33.483Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T10:30:36.234Z","attemptedAt":"2026-10-28T10:30:36.234Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T10:30:36.238Z","attemptedAt":"2026-10-28T10:30:36.238Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T10:30:36.238Z","attemptedAt":"2026-10-28T10:30:36.238Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T10:30:36.238Z","attemptedAt":"2026-10-28T10:30:36.238Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-113485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113485","modified":"2026-10-28T06:16:34.957","checkedAt":"2026-10-28T10:30:36.234Z"},{"source":"GitHub Advisory Database","id":"GHSA-vj27-pxm6-rv65","url":"https://github.com/advisories/GHSA-vj27-pxm6-rv65","modified":"2026-10-28T06:30:32Z","checkedAt":"2026-10-28T10:30:36.238Z"},{"source":"ENISA EUVD","id":"EUVD-2026-111723","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111723","modified":"Oct 28, 2026, 6:00:25 AM","checkedAt":"2026-10-28T10:30:36.238Z"}]}