Description

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.

Related CPE's

Could not find any relations

References

Weaknesses

Could not find any weaknesses

CVSS impact metrics

Could not find any metrics

Information