CVE-2024-0385

Name of the Vulnerable Software and Affected Versions Categorify plugin for WordPress versions up to, and including, 1.0.7.4

Description The issue allows authenticated attackers with subscriber-level access and above to modify data without proper authorization. This is due to a missing capability check on the categorifyAjaxAddCategory function.

Recommendations For versions up to, and including, 1.0.7.4, update to a version that includes a fix for the missing capability check on the categorifyAjaxAddCategory function. As a temporary workaround, consider restricting access to the categorifyAjaxAddCategory function to prevent unauthorized data modification.