The Categorify – WordPress Media Library Category & File Manager plugin suffers from a missing authorization check (CWE-862) in the categorifyAjaxDeleteCategory function. This flaw enables any authenticated user with subscriber-level privileges or higher to delete categories, which should normally require higher permissions. The vulnerability affects all versions up to and including 1.0.7.4. The CVSS 3.1 base score is 4.3, reflecting low attack complexity and the need for authentication but limited impact to integrity only. No patch or official fix has been disclosed as of the publication date.

An attacker with subscriber-level access or above can delete categories in the WordPress media library managed by the Categorify plugin without proper authorization. This unauthorized modification can disrupt content organization but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious category deletions. Avoid granting subscriber-level access to untrusted users.