CVE-2015-1614: Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress

This month

MEDIUM 6.8MITIGATE

CVE-2015-1614 is a medium-severity flaw (CVSS 6.8) affecting image metadata cruncher. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) image_metadata_cruncher[alt] or (2) image_metadata_cruncher[caption] parameter in an update action in the image_metadata_cruncher_title page to wp-admin/options.php or (3) custom image meta tag to

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	6.8 (Medium)
EPSS exploit chance	1.2% (top 32%)
CISA exploited list	No
Weakness	CWE-352
Published	2015-02-19
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: image metadata cruncher project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2015-02-19 15:59 UTCPublished CVE record published
2026-06-17 00:22 UTCUpdated Record last modified

image metadata cruncher project image metadata cruncher MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy image-metadata-cruncher || rpm -q image-metadata-cruncher || image-metadata-cruncher --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2015-1614?

image metadata cruncher: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2015-1614 being exploited?

CVE-2015-1614 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2015-1614 affect?

CVE-2015-1614 affects image metadata cruncher. Severity is medium (CVSS 6.8). Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attack

How urgent is CVE-2015-1614?

Priority 41/100. No elevated risk signals yet.

Software pages

WordPress vulnerabilities · PHP vulnerabilities

References

← Back to latest CVEs