CVE-2024-1907 is a CSRF vulnerability in the frenify Categorify WordPress plugin affecting all versions up to 1.0.7.4. The issue arises from missing or incorrect nonce validation in the categorifyAjaxDeleteCategory function, enabling attackers to perform unauthorized category deletions by convincing an authenticated administrator to execute a malicious request. The vulnerability does not require privileges or direct user interaction beyond the administrator clicking a crafted link.

An attacker can cause a site administrator to unknowingly delete categories within the WordPress media library by exploiting the CSRF vulnerability. This results in limited impact affecting the integrity of category data but does not affect confidentiality or availability. There is no indication of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring vendor channels for updates is recommended.