The plugin contains a CSRF weakness that permits an attacker to cause a logged‑in user to perform actions without their consent. The flaw may lead to unauthorized changes to media categories, site settings or content, thereby compromising the integrity (and potentially confidentiality) of the site.

WordPress sites that have the WP Media Categories plugin by John James Jacoby installed and running any version up to and including 2.1.0 are affected.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1 % shows very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a legitimate user session—such as an administrator logged into the site—to trigger the action from a malicious page, as the absence of a CSRF token allows the request to be submitted unchallenged.