Description
The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
INFO
Published Date :
2025-02-19T07:32:05.707Z
Last Modified :
2025-02-19T21:18:21.055Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2025-0865 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-0865.
