# CVE-2026-97295: Media Library Assistant cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-97295-cross-site-request-forgery-csrf-vulnerability-in-david-lingren  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-97295 · Severity: medium · CVSS 4.3 · Published 2026-10-26

Media Library Assistant is a WordPress plugin that helps manage and organize media files within WordPress sites. A cross-site request forgery (CSRF) vulnerability allows attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or content, by luring them to a malicious website. This could result in unauthorized changes to a WordPress site's media library or configuration.

Technologies: [David Lingren Media Library Assistant](https://junglewise.ai/threats/technologies/media-library-assistant). Vendors: [David Lingren](https://junglewise.ai/threats/vendors/david-lingren).

## Quick answers

**Is CVE-2026-97295 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97295 being exploited in the wild.

**How severe is CVE-2026-97295?** Medium severity, with a CVSS score of 4.3, published 26 October 2026.

**Which products and versions are affected?** David Lingren Media Library Assistant up to 3.42.

**Is there a fix for CVE-2026-97295?** Yes: fixed in 3.43. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97295 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97295?** Check whether you run David Lingren Media Library Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.43

## Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw in the Media Library Assistant WordPress plugin affecting versions up to and including 3.42. Exploitation requires user interaction: a logged-in administrator must visit an attacker-controlled webpage or click a malicious link. The attacker gains the ability to perform administrative actions on the target WordPress site without the user's knowledge or consent.

## Affected products

- David Lingren Media Library Assistant up to 3.42

## Timeline

- 2026-09-19: disclosed: Reported to Patchstack
- 2026-10-26: advisory: Published by Patchstack and NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-42-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-42-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)

## Related threats

- [David Lingren Media Library Assistant XSS in content injection](https://junglewise.ai/threats/cve-2026-119496-improper-neutralization-of-script-related-html-tags-in-a-web)
- [David Lingren Media Library Assistant broken access control](https://junglewise.ai/threats/cve-2026-119491-missing-authorization-vulnerability-in-david-lingren-media)
- [Media Library Assistant DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-118095-improper-neutralization-of-input-during-web-page-generation)
- [Media Library Assistant CSRF in bulk-action handler](https://junglewise.ai/threats/cve-2026-113485-the-media-library-assistant-wordpress-plugin-before-3-42-does)
- [Media Library Assistant SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-115948-improper-neutralization-of-special-elements-used-in-an-sql)