What is the CVSS score of CVE-2025-60134?

CVE-2025-60134 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Media Categories CVE-2025-60134

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-22 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible, low complexity, no privileges; user interaction required (lure admin), integrity impact limited to low, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:34 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.

AnalysisAI

Cross-Site Request Forgery in the WP Media Categories plugin for WordPress allows unauthenticated attackers to trick a logged-in administrator into making unauthorized requests, potentially altering media category settings. The vulnerability affects versions up to 2.1.0 and has a low integrity impact with no confidentiality or availability loss. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.02%).

Technical ContextAI

The vulnerability lies in the WP Media Categories WordPress plugin, identified as CWE-352 (Cross-Site Request Forgery), indicating missing or insufficient anti-CSRF tokens (nonces) on state-changing requests. The plugin (CPE: cpe:2.3:a:johnjamesjacoby:wp_media_categories:*:*:*:*:*:wordpress:*:* up to 2.1.0) fails to verify that admin-initiated actions are intentional, allowing forged requests via a targeted user's authenticated session. This is a common web application security flaw where the server does not distinguish between legitimate and maliciously crafted requests.

Affected ProductsAI

WP Media Categories plugin for WordPress versions from n/a through 2.1.0 are affected. The vulnerable component is identified as cpe:2.3:a:johnjamesjacoby:wp_media_categories:*:*:*:*:*:wordpress:*:*. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-media-categories/vulnerability/wordpress-wp-media-categories-plugin-2-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve details the issue and should be consulted for exact version information and a fix.

RemediationAI

Upgrade to a patched version of the WP Media Categories plugin beyond 2.1.0 as outlined in the Patchstack advisory (see link above). If no updated version is available, consider disabling the plugin until a fix is released. As a temporary workaround, administrators should avoid clicking untrusted links while logged into WordPress; however, this is not a robust control. Monitor the vendor's plugin page or the Patchstack advisory for official remediation guidance.