CVE-2024-1910: Categorify WordPress Plugin CSRF Vulnerability

CVE-2024-1910 Overview

CVE-2024-1910 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Categorify plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.7.4. The vulnerability stems from missing or incorrect nonce validation on the categorifyAjaxClearCategory function. Unauthenticated attackers can clear site categories by tricking an authenticated administrator into clicking a crafted link. The attack requires user interaction but no privileges on the target site.

Critical Impact
Successful exploitation allows an unauthenticated attacker to clear WordPress categories managed by the Categorify plugin by abusing an administrator's authenticated session.

Affected Products

Frenify Categorify plugin for WordPress — all versions through 1.0.7.4
WordPress sites running the vulnerable plugin with an active administrator session
CPE: cpe:2.3:a:frenify:categorify:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2024-02-27 - CVE-2024-1910 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1910

Vulnerability Analysis

The Categorify plugin exposes an AJAX action handled by the categorifyAjaxClearCategory function. This handler performs a destructive operation — clearing categories — without validating a WordPress nonce. Nonces are the primary CSRF defense in WordPress and must be verified using functions such as check_ajax_referer() or wp_verify_nonce() before any state-changing action.

Because the handler does not confirm the request originated from a legitimate plugin UI, any browser session with an active administrator cookie will execute the request. An attacker hosts a page containing a forged request to the vulnerable endpoint and lures an administrator to visit it. The browser automatically attaches session cookies, and WordPress processes the action under the administrator's identity.

Root Cause

The root cause is missing anti-CSRF token verification in the categorifyAjaxClearCategory AJAX handler. The function is reachable through the standard admin-ajax.php entry point and executes without validating request origin or nonce authenticity.

Attack Vector

Exploitation requires network access to the target site and user interaction from an authenticated administrator. An attacker crafts an HTML page, email, or forum post containing an auto-submitting form or image tag that triggers a request to admin-ajax.php with the vulnerable action parameter. When the administrator visits the attacker-controlled resource, the browser issues the request with valid authentication cookies, and categories are cleared without consent. No code execution or data theft occurs, but site taxonomy integrity is lost. Review the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-1910

Indicators of Compromise

Unexpected clearing or emptying of WordPress categories managed by the Categorify plugin
POST requests to /wp-admin/admin-ajax.php with the categorifyAjaxClearCategory action and an HTTP Referer header pointing to an external domain
Administrator-attributed category modifications correlated with outbound browsing to untrusted sites

Detection Strategies

Review web server access logs for requests to admin-ajax.php carrying the categorifyAjaxClearCategory action and inspect the Referer and Origin headers for off-site values
Enable WordPress audit logging to capture administrator-initiated taxonomy changes and alert on bulk category deletions
Compare installed Categorify plugin version against 1.0.7.4 across the WordPress estate

Monitoring Recommendations

Monitor plugin inventory and alert when vulnerable Categorify versions are present
Alert on anomalous spikes in admin-ajax activity from a single administrator session
Track changes to the WordPress wp_terms and wp_term_taxonomy tables for sudden mass updates

How to Mitigate CVE-2024-1910

Immediate Actions Required

Update the Categorify plugin to a version later than 1.0.7.4 that includes the fix from WordPress Categorify Changeset 3034410
Deactivate and remove the Categorify plugin if an updated version is unavailable or no longer in use
Instruct administrators to log out of WordPress sessions before browsing untrusted sites

Patch Information

The vendor addressed the issue in the changeset referenced at WordPress Categorify Changeset 3034410, which introduces nonce validation on the affected AJAX handler. Site operators should apply plugin updates through the WordPress dashboard or by replacing the plugin directory with the patched release.

Workarounds

Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer
Deploy a Web Application Firewall rule that blocks requests to admin-ajax.php where the action parameter equals categorifyAjaxClearCategory and the Referer is external
Enforce SameSite=Strict cookie attributes on WordPress authentication cookies to reduce cross-site cookie attachment

bash

# Example nginx rule blocking cross-origin requests to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "categorifyAjaxClearCategory") {
        if ($http_referer !~* "^https?://your-site\.com/") {
            return 403;
        }
    }
}