The WP Media Categories plugin for WordPress, developed by John James Jacoby, contains a CSRF vulnerability in versions up to 2.1.0. This vulnerability enables attackers to induce authenticated users to execute unwanted actions without their consent. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact is limited to integrity with no confidentiality or availability loss. No patch or remediation details have been provided yet.

The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, potentially modifying data or settings related to media categories. There is no direct impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted websites and avoid clicking on suspicious links while authenticated in WordPress. Monitor official sources for updates and patches.