Threats tagged 'ghsa-vj27-pxm6-rv65'

A vulnerability in the Media Library Assistant WordPress plugin before version 3.42 allows an attacker to perform unauthorized bulk deletion or trashing of media attachments. This occurs because the plugin inconsistently validates the CSRF nonce on the bulk-action handler, only checking it when the nonce field is present. A forged request omitting this field can exploit this flaw if performed by a logged-in user with Author role or higher.