Is CVE-2026-113486 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-113486

Description

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.