CVE-2025-28948
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-28948 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Mediabay - WordPress Media Library Folders plugin (versions up to 1.4). It allows an attacker to trick authenticated, higher privileged users into performing unintended actions. This CSRF vulnerability can lead to reflected Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in the context of the victim's browser, potentially compromising site security. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to force privileged users to execute unwanted actions while authenticated, potentially leading to unauthorized changes or data exposure. The reflected XSS aspect can enable attackers to run malicious scripts in users' browsers, which may result in theft of sensitive information, session hijacking, or other malicious activities. Since no official patch exists, the risk remains until mitigated by virtual patching or other security measures. [1]
What immediate steps should I take to mitigate this vulnerability?
Since there is no official patch available for this vulnerability, immediate mitigation steps include applying virtual patching (vPatching) provided by Patchstack to auto-mitigate the issue without performance loss. Additionally, users should monitor for updates and consider implementing security measures to prevent CSRF and reflected XSS attacks, such as restricting access to privileged users and using web application firewalls. [1]