CVE-2024-1912: Frenify Categorify CSRF Vulnerability

CVE-2024-1912 Overview

CVE-2024-1912 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Categorify plugin for WordPress in all versions up to and including 1.0.7.4. The flaw exists in the categorifyAjaxUpdateFolderPosition function, which lacks proper nonce validation. Unauthenticated attackers can forge requests that modify folder positions of categories and alter metadata of other taxonomies. Exploitation requires tricking a site administrator into clicking a crafted link while authenticated. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to tamper with WordPress taxonomy metadata and category folder structures through forged administrator-triggered requests.

Affected Products

Frenify Categorify plugin for WordPress
All versions up to and including 1.0.7.4
WordPress sites with the Categorify plugin active

Discovery Timeline

2024-02-27 - CVE-2024-1912 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1912

Vulnerability Analysis

The Categorify plugin exposes an AJAX endpoint handled by the categorifyAjaxUpdateFolderPosition function. This handler processes state-changing requests without verifying a WordPress nonce token. Nonces are the standard CSRF protection mechanism in WordPress and must be validated with functions such as check_ajax_referer() or wp_verify_nonce().

Because the handler trusts the authenticated session cookie alone, any request originating from the administrator's browser is accepted. An attacker who lures an authenticated administrator to a malicious page can issue cross-origin requests that reach the AJAX endpoint. The plugin then executes taxonomy changes under the administrator's privileges.

The impact is limited to integrity of taxonomy metadata and folder ordering. No confidentiality loss or availability degradation results directly from the flaw.

Root Cause

The root cause is missing or incorrect nonce validation in the categorifyAjaxUpdateFolderPosition AJAX action. WordPress exposes the admin-ajax.php endpoint to any session, so handlers must independently verify request origin. The absence of nonce verification allows forged requests to reach privileged logic.

Attack Vector

An attacker hosts a page containing an auto-submitting form or JavaScript that targets admin-ajax.php with the vulnerable action. The attacker then delivers the link through phishing, forum posts, or embedded content. When a logged-in administrator loads the page, the browser attaches session cookies and the request executes the folder position update. The attacker does not need authentication credentials or any prior access to the target site.

The vulnerability requires user interaction, which limits mass exploitation but suits targeted attacks against WordPress site owners.

Detection Methods for CVE-2024-1912

Indicators of Compromise

Unexpected changes to category folder ordering within the Categorify plugin interface
Modifications to taxonomy metadata that do not correspond to legitimate administrator activity
Access log entries for wp-admin/admin-ajax.php referencing the categorifyAjaxUpdateFolderPosition action from external referrers
Administrator sessions showing POST requests to admin-ajax.php with cross-origin Referer headers

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php with action=categorifyAjaxUpdateFolderPosition and correlate with the Referer header
Audit WordPress database tables wp_termmeta and wp_terms for unexplained modifications timestamped near administrator login sessions
Deploy WordPress audit logging plugins to capture taxonomy change events with user attribution

Monitoring Recommendations

Monitor outbound links clicked by administrators from webmail and chat applications for suspicious destinations
Alert on AJAX requests to the Categorify endpoint originating from referrers outside the site's own domain
Track plugin version inventory across managed WordPress installations to identify instances still running 1.0.7.4 or earlier

How to Mitigate CVE-2024-1912

Immediate Actions Required

Update the Categorify plugin to a version later than 1.0.7.4 that includes the nonce validation fix referenced in the WordPress plugin changeset 3034410
Deactivate the Categorify plugin if an update cannot be applied immediately
Instruct administrators to log out of WordPress before browsing untrusted sites or clicking external links
Review recent taxonomy and category changes for unauthorized modifications

Patch Information

The vendor addressed the issue in the Categorify plugin via changeset 3034410. Review the fix details in the WordPress Plugins Change Log and the Wordfence Vulnerability Report. Site operators should upgrade to the latest available version of the plugin from the WordPress plugin repository.

Workarounds

Restrict administrative access to WordPress using IP allowlisting at the web server or firewall level
Deploy a Web Application Firewall (WAF) with CSRF protection rules that validate Referer and Origin headers on admin-ajax.php requests
Enforce separate browser profiles or dedicated workstations for WordPress administration tasks
Require re-authentication for administrative sessions after short idle periods to reduce the exploitation window

bash

# Example WAF rule concept blocking cross-origin requests to the vulnerable action
# ModSecurity rule (illustrative)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1009121,msg:'CVE-2024-1912 CSRF block'"
  SecRule ARGS:action "@streq categorifyAjaxUpdateFolderPosition" "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"