Media Library Assistant CVE-2026-97295

Exploitation requires a victim who is authenticated to the WordPress site (the plugin's privileged context) to be tricked into visiting attacker-controlled content, so the forged request rides their existing session (UI:R in the CVSS vector). The attacker needs no account or privileges of their own (PR:N) but cannot act without that logged-in victim. The specific plugin feature, action, or endpoint affected is not described in the available sources; the description states only a generic CSRF through version 3.42. Impact is limited to integrity (I:L) with no confidentiality or availability effect, which further bounds what a successful attack can achieve.

This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable CSRF that requires no attacker privileges but DOES require user interaction (UI:R) - a logged-in user must be tricked into triggering the forged request - and yields only limited integrity impact (I:L) with no confidentiality or availability effect. The vuln.today priority is 'this_month' (not act_now/emergency), consistent with the modest impact. KEV status is not present, so there is no confirmed active exploitation; EPSS is not provided in the input, so exploitation probability cannot be quantified. The sole reference is a Patchstack database advisory, not verified working exploit code, so no public exploit is identified. The reliance on UI:R plus only low integrity impact means real-world risk is bounded: this is a genuine but low-urgency fix, not a high-CVSS-but-overrated anomaly nor a critical one. No conflicting signals were detected between the vector and the description (both point to a classic CSRF).

An attacker crafts a malicious web page or link and lures a user who is authenticated to the WordPress admin into visiting it; the page silently submits a forged request to the Media Library Assistant plugin, performing a state-changing action in that user's session. Because the flaw is network-reachable with no attacker authentication but requires victim interaction, success depends on social engineering a logged-in victim. No verified public exploit code is identified at the time of analysis.