CVE-2021-24788

Name of the Vulnerable Software and Affected Versions: Batch Cat WordPress plugin versions 0.3 and earlier

Description: The issue allows any authenticated user, including simple subscribers, to add, set, or delete arbitrary categories to posts. This is because the plugin defines 3 custom AJAX actions that require authentication but are available for all roles.

Recommendations: For Batch Cat WordPress plugin versions 0.3 and earlier, update to a version that fixes this issue to restrict access to custom AJAX actions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.