diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php
index 6f5c153cd..59feb8cec 100644
--- a/wp-admin/async-upload.php
+++ b/wp-admin/async-upload.php
@@ -26,6 +26,8 @@ if ( ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) {
 	exit;
 }
 
+check_admin_referer('media-form');
+
 $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
 if (is_wp_error($id)) {
 	echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index 0e3413796..c40110cd5 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -790,6 +790,7 @@ jQuery(function($){
 			post_params : {
 				"post_id" : "<?php echo $post_id; ?>",
 				"auth_cookie" : "<?php echo $_COOKIE[AUTH_COOKIE]; ?>",
+				"_wpnonce" : "<?php echo wp_create_nonce('media-form'); ?>",
 				"type" : "<?php echo $type; ?>",
 				"tab" : "<?php echo $tab; ?>",
 				"short" : "1"