CVE-2024-1909: Categorify WordPress Plugin CSRF Vulnerability

CVE-2024-1909 Overview

CVE-2024-1909 is a Cross-Site Request Forgery (CSRF) vulnerability in the Categorify plugin for WordPress [CWE-352]. The flaw affects all versions up to and including 1.0.7.4. The categorifyAjaxRenameCategory function lacks proper nonce validation, allowing unauthenticated attackers to rename WordPress categories through forged requests. Exploitation requires tricking a site administrator into clicking a crafted link or visiting a malicious page while authenticated. The vulnerability impacts content integrity on affected WordPress sites running the Frenify Categorify plugin.

Critical Impact
Unauthenticated attackers can rename WordPress categories by tricking administrators into clicking malicious links, affecting site content organization and integrity.

Affected Products

Frenify Categorify plugin for WordPress
All versions up to and including 1.0.7.4
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-02-27 - CVE-2024-1909 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1909

Vulnerability Analysis

The vulnerability resides in the categorifyAjaxRenameCategory AJAX handler within the Categorify plugin. The handler processes category rename requests but fails to verify a valid WordPress nonce before executing the action. WordPress nonces exist specifically to defend against CSRF attacks by binding sensitive actions to a user session and request context.

Without nonce validation, the server cannot distinguish between legitimate administrator-initiated requests and forged requests originating from attacker-controlled pages. An attacker can craft an HTML form or JavaScript payload that submits a rename request to the vulnerable endpoint. When an authenticated administrator loads the attacker's content, the browser automatically includes session cookies, and the request succeeds.

The impact is limited to category renaming, which affects content taxonomy and site navigation rather than enabling code execution or data exfiltration. See the Wordfence Vulnerability Report for additional detail.

Root Cause

The root cause is missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. WordPress provides wp_verify_nonce() and check_ajax_referer() as standard CSRF defenses, but the vulnerable handler does not invoke these checks before processing input.

Attack Vector

Exploitation requires network access and user interaction. The attacker crafts a malicious page containing an auto-submitting form targeting the WordPress site's admin-ajax endpoint. When a logged-in administrator visits the page, typically via a phishing link, the browser forwards the request with valid authentication cookies. The server processes the rename as if initiated by the administrator.

Detection Methods for CVE-2024-1909

Indicators of Compromise

Unexpected category name changes in the WordPress admin dashboard that cannot be attributed to legitimate administrator activity
POST requests to admin-ajax.php with action=categorifyAjaxRenameCategory originating from external HTTP referrers
Administrator session activity immediately following clicks on external links in email or chat applications

Detection Strategies

Monitor web server access logs for requests to wp-admin/admin-ajax.php containing the categorifyAjaxRenameCategory action, particularly those with suspicious or missing Referer headers
Enable WordPress audit logging plugins to track category modification events and correlate them with administrator session activity
Review the installed Categorify plugin version and flag any instance at or below 1.0.7.4

Monitoring Recommendations

Alert on changes to WordPress taxonomy terms by auditing database writes to the wp_terms table
Track administrator browsing patterns for navigation to untrusted external domains preceding category modifications
Correlate CSRF-pattern requests against web application firewall (WAF) telemetry to identify forged submissions

How to Mitigate CVE-2024-1909

Immediate Actions Required

Update the Categorify plugin to a version newer than 1.0.7.4 that includes the nonce validation fix
Audit WordPress category names and restore any that have been altered without authorization
Instruct administrators to log out of WordPress sessions before browsing untrusted sites or clicking external links

Patch Information

The vendor addressed the issue in the Categorify plugin repository. Review the fix in the WordPress Categorify Changeset 3034410 and upgrade to the patched release available through the WordPress plugin directory.

Workarounds

Deactivate and remove the Categorify plugin until the patched version can be applied
Deploy a WordPress-aware WAF rule that blocks requests to admin-ajax.php with the categorifyAjaxRenameCategory action when the Referer header does not match the site origin
Restrict WordPress administrator accounts to dedicated browsers or sessions used only for site administration tasks

bash

# Example WAF rule logic to block cross-origin requests to the vulnerable endpoint
# Pseudocode - adapt to your WAF syntax (ModSecurity, Cloudflare, etc.)
if request.uri contains "/wp-admin/admin-ajax.php" \
   and request.body contains "action=categorifyAjaxRenameCategory" \
   and request.header.Referer does_not_start_with "https://your-site.example.com" \
   then block