CVE-2024-1907: Categorify WordPress Plugin CSRF Vulnerability

CVE-2024-1907 Overview

CVE-2024-1907 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Categorify plugin for WordPress. The flaw exists in all versions up to and including 1.0.7.4. It stems from missing or incorrect nonce validation on the categorifyAjaxDeleteCategory function. Unauthenticated attackers can delete categories from a target WordPress site by tricking an authenticated administrator into clicking a crafted link or visiting a malicious page. Successful exploitation causes unauthorized modification of site taxonomy data without the administrator's consent.

Critical Impact
Unauthenticated attackers can delete WordPress categories on affected sites by luring an administrator into a single click, causing integrity loss across site taxonomy.

Affected Products

Frenify Categorify plugin for WordPress
All versions up to and including 1.0.7.4
WordPress sites with the plugin active and administrator sessions available

Discovery Timeline

2024-02-27 - CVE-2024-1907 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-1907

Vulnerability Analysis

The Categorify plugin exposes an AJAX action handled by the categorifyAjaxDeleteCategory function. This handler performs a destructive operation, deleting a WordPress category, without validating a WordPress nonce token. Nonces in WordPress are the primary defense against Cross-Site Request Forgery on administrative endpoints. Their absence allows any browser holding a valid administrator session to be coerced into executing the delete action on behalf of an attacker.

Because the endpoint accepts requests without verifying request origin or intent, an attacker only needs to induce user interaction from an authenticated administrator. Exploitation does not require credentials or elevated privileges on the attacker's side. The impact is limited to integrity loss on category data. Confidentiality and availability of the wider system are not directly affected.

Root Cause

The root cause is a missing or incorrect wp_verify_nonce check on the AJAX handler categorifyAjaxDeleteCategory. WordPress plugin developers are expected to pair destructive AJAX actions with check_ajax_referer or an equivalent nonce validation call. The plugin author omitted this control, leaving the endpoint reachable by any request that carries administrator session cookies.

Attack Vector

An attacker crafts a web page or link that issues an AJAX request to the vulnerable endpoint on the target WordPress site. The attacker then delivers this link through phishing, forum posts, or embedded content. When an authenticated administrator visits the attacker-controlled resource, the browser automatically attaches session cookies to the outbound request. The Categorify plugin processes the request as legitimate and deletes the specified category.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-1907

Indicators of Compromise

Unexpected deletion of categories in the WordPress taxonomy, particularly outside normal editorial hours
Access log entries showing POST requests to admin-ajax.php with the categorifyAjaxDeleteCategory action originating from external Referer headers
Administrator sessions generating AJAX traffic immediately after visiting third-party links or opening emailed URLs

Detection Strategies

Inspect WordPress access logs for admin-ajax.php requests carrying the categorifyAjaxDeleteCategory action and cross-reference the Referer header against the site origin
Enable WordPress audit logging plugins to record taxonomy delete events with the acting user, timestamp, and source IP
Correlate administrator browser activity with unexpected category modifications to identify CSRF-driven changes

Monitoring Recommendations

Alert on any category delete operations performed through AJAX endpoints outside of administrative UI navigation
Monitor for spikes in admin-ajax.php traffic tied to the Categorify plugin actions
Track installations of Frenify Categorify across the estate and flag versions at or below 1.0.7.4

How to Mitigate CVE-2024-1907

Immediate Actions Required

Update the Categorify plugin to a version above 1.0.7.4 that includes the nonce validation fix referenced in the WordPress Categorify Changeset
Deactivate and remove the Categorify plugin if a patched version cannot be applied
Instruct administrators to log out of WordPress before browsing untrusted links or content

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Categorify Changeset for the corrective code that adds nonce validation to the affected AJAX handler. Site operators should upgrade to the first release that includes this changeset.

Workarounds

Restrict administrator accounts to dedicated browsers or browser profiles that are not used for general web browsing
Deploy a Web Application Firewall (WAF) rule to block admin-ajax.php requests with the categorifyAjaxDeleteCategory action when the Referer header does not match the site origin
Limit the number of accounts with the manage_categories capability to reduce the pool of viable CSRF targets

bash

# Example WAF rule concept - block off-origin CSRF against the vulnerable action
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1907001,msg:'Blocked Categorify CSRF attempt'"
    SecRule ARGS:action "@streq categorifyAjaxDeleteCategory" "chain"
        SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example"