The Categorify plugin for WordPress Media Library Category & File Manager suffers from a missing authorization check (CWE-862) in the categorifyAjaxAddCategory function. This flaw permits authenticated users with low privileges (subscriber-level and above) to add categories without proper permission validation. The issue affects all versions up to and including 1.0.7.4. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity of attack but limited impact confined to integrity of category data. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

The vulnerability allows unauthorized modification of category data by authenticated users with subscriber-level access or higher. It does not affect confidentiality or availability but impacts data integrity within the plugin's category management functionality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber-level user capabilities or disabling the plugin if unauthorized category modification poses a risk in your environment.