CVE-2024-1650 is a missing authorization vulnerability (CWE-862) in the Categorify WordPress plugin, specifically in the categorifyAjaxRenameCategory function. This function does not perform adequate capability checks, enabling authenticated users with low privileges (subscriber-level and above) to rename categories in the media library. This unauthorized modification of data could lead to integrity issues within the plugin's category management. The vulnerability affects all versions up to 1.0.7.4 and has a CVSS 3.1 base score of 4.3, indicating medium severity. No patch or official fix has been documented as of the published date.

An attacker with subscriber-level access or higher can rename categories in the WordPress media library managed by the Categorify plugin without proper authorization. This could lead to unauthorized modification of category data, potentially causing confusion or mismanagement of media files. There is no indication of confidentiality or availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to category renaming. Avoid granting subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for any forthcoming patches or official mitigations.