CVE-2024-1906

Summary

CVE-2024-1906 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Categorify plugin for WordPress. This issue, present in all versions up to 1.0.7.4, stems from insufficient or flawed nonce validation within the categorifyAjaxAddCategory function. As a result, unauthenticated attackers can manipulate administrators into executing malicious actions, such as adding unwanted categories, by tricking them into clicking on a specially crafted link.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.