Cross-Site Request Forgery Vulnerability in WP Media Categories by John James Jacoby
CVE-2025-60134

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Media Categories
Vendor
CVE Published:
22 October 2025

What is CVE-2025-60134?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Media Categories plugin developed by John James Jacoby, affecting versions up to 2.1.0. This flaw can be exploited by an attacker to perform unauthorized actions on behalf of unsuspecting users. If successfully executed, it can lead to changing the settings or configurations of the media categories without the user's consent, potentially compromising the integrity of the website.

Affected Version(s)

WP Media Categories <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/wp-m...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
JSON
.