CVE-2024-1912 describes a CSRF vulnerability in the frenify Categorify plugin for WordPress Media Library Category & File Manager, affecting all versions up to 1.0.7.4. The issue arises from missing or incorrect nonce validation on the categorifyAjaxUpdateFolderPosition function, enabling attackers to perform unauthorized updates to category folder positions and taxonomy metadata by tricking an authenticated administrator into executing a malicious request. The vulnerability requires user interaction (UI:R) and does not allow direct confidentiality or availability impact but can cause integrity loss of taxonomy data.

An attacker can cause an authenticated administrator to unknowingly modify category folder positions and taxonomy metadata through forged requests. This impacts the integrity of the WordPress media library organization but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress and consider implementing additional CSRF protections or nonce validation checks if possible.