The Categorify plugin for WordPress Media Library Category & File Manager suffers from a missing authorization check in the categorifyAjaxClearCategory function. This flaw permits any authenticated user with at least subscriber privileges to clear categories, which constitutes unauthorized modification of data. The vulnerability affects all versions up to 1.0.7.4. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no indication of a vendor patch or official fix available at this time.

An attacker with subscriber-level access or higher can exploit this vulnerability to clear categories in the WordPress media library managed by the Categorify plugin. This unauthorized modification can disrupt category organization and potentially affect site content management. There is no direct impact on confidentiality or availability reported, and no known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to category modifications. Avoid granting subscriber or higher privileges to untrusted users to reduce risk.