CVE-2026-97295
Received Received - Intake

Cross-Site Request Forgery in Media Library Assistant

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Patchstack

Description
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-97295
EUVD
EUVD-2026-109715

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
David Lingren Media LIbrary Assistant 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-97295 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Media Library Assistant plugin affecting versions 3.42 and below. It allows attackers to trick authenticated users into performing unintended actions via malicious links or crafted pages.

Detection Guidance

Detecting this CSRF vulnerability requires checking the installed version of the Media Library Assistant plugin. Use WordPress admin panel to view plugin versions or run SQL queries on the database to check plugin versions. Commands like 'wp plugin list' in WP-CLI can also list installed plugins and their versions.

Impact Analysis

This vulnerability could allow attackers to perform actions on behalf of authenticated users, such as changing passwords or making unauthorized purchases, if a privileged user clicks a malicious link or visits a crafted page.

Mitigation Strategies

Immediately update the Media Library Assistant plugin to version 3.43 or later. If updating is not possible, seek assistance from a hosting provider or web developer. Enable auto-updates for vulnerable plugins if using Patchstack.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart