Media Library Assistant CVE-2026-113486

Exploitation requires that the victim be a logged-in user with the Editor role or above and that they visit or interact with attacker-controlled content while that WordPress session is active - this is the UI:R user-interaction requirement. The specific flaw is that the plugin's 'Empty Trash' media action does not verify a CSRF nonce, so any cross-origin request issued with the victim's session is honored. Meaningful impact additionally depends on the site actually having trashed media attachments present, since only trashed attachments are destroyed. Limiting factors: the attacker needs no account but cannot act alone - they must successfully trick a privileged (Editor+) user; the affected plugin must be installed and running a version before 3.42; and impact is confined to deletion of already-trashed attachments rather than live media or other data.

Signals are consistent and point to a genuine but moderate-priority issue rather than an urgent one. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - network-reachable, low complexity, no attacker privileges, but requiring victim interaction, with impact scored as integrity-only (permanent deletion of trashed attachments). EPSS is very low at 0.11% (1st percentile), indicating no meaningful mass-exploitation signal, and there is no CISA KEV listing and no confirmed public exploit, so active exploitation is not indicated. The vuln.today decision label is 'this_month,' which aligns with the low EPSS and absence of KEV: patch in a normal cycle rather than as an emergency. One point of tension worth noting: the CVSS vector records PR:N (unauthenticated) because the attacker themselves needs no account, but the described impact only occurs against a logged-in Editor-or-above victim who is socially engineered into issuing the forged request - so 'unauthenticated' describes the attacker, not the privilege context of the action. Additionally, the real-world damage is bounded to attachments already in the trash (items a user had already marked for removal), which makes the I:H rating arguably generous relative to practical impact.

An attacker crafts a malicious web page or email containing a hidden auto-submitting request that targets the plugin's Empty Trash media endpoint. When a logged-in Editor or administrator of the target WordPress site visits that page in the same browser session, their authenticated cookies cause the forged request to execute, permanently deleting every trashed attachment on the site. No public exploit is identified at the time of analysis, though a public advisory (WPScan) describes the flaw.