🔐 CVE Alert

CVE-2025-0865

MEDIUM 6.5

WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE CWE-352
Vendor debaat
Product wp media category management
Published Feb 19, 2025
Last Updated Feb 19, 2025
Stay Ahead of the Next One

Get instant alerts for debaat wp media category management

Be the first to know when new medium vulnerabilities affecting debaat wp media category management are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

debaat / WP Media Category Management
2.0 ≤ 2.3.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0d42ca2f-f061-4cd1-812b-46d42c440498?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-media-category-management/trunk/include/admin/class-WP_MCM_Settings.php plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-media-category-management/tags/2.3.3/include/admin/class-WP_MCM_Render_Settings.php plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/wp-media-category-management/trunk/include/class-WP_MCM_Options.php wordpress.org: https://wordpress.org/plugins/wp-media-category-management/#developers plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3242626/wp-media-category-management/trunk/include/admin/class-WP_MCM_Settings.php

Credits

lucky_buddy