What is GHSA-cr4r-w36f-j7h9?

GHSA-cr4r-w36f-j7h9 is a security advisory published by GitHub Security Advisories with Medium severity. The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its...

Which CVE IDs does GHSA-cr4r-w36f-j7h9 cover?

GHSA-cr4r-w36f-j7h9 covers the following CVE IDs: CVE-2026-113486. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cr4r-w36f-j7h9?

GHSA-cr4r-w36f-j7h9 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-cr4r-w36f-j7h9MediumCVSS 6.5

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its...

Vendor

GitHub Security Advisories

Published

October 28, 2026

Last Modified

October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-113486 →

📋 Description

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-113486
https://wpscan.com/vulnerability/29f5c90d-564a-4844-bf8e-b72243da5a0a
https://github.com/advisories/GHSA-cr4r-w36f-j7h9