Categorify – WordPress Media Library Category & File Manager
categorify · plugin
Known security vulnerabilities for Categorify – WordPress Media Library Category & File Manager. Find out in seconds which version runs on your site with WP Lens.
11 known vulnerabilities
5 exploitable without logging in · 1 with no official fix seen · latest Sep 9, 2025
Listed on wordpress.org · latest 1.0.7.5 · last updated Feb 12, 2024 · 1K+ installs
Not updated since Feb 12, 2024. A component left without updates for over two years should not be expected to patch new vulnerabilities.
wordpress.org status checked on Oct 4, 2026
Vulnerabilities
- Medium 4.3
CVE-2024-1912unauthenticated · needs a click≤ 1.0.7.4
Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition
- Medium 4.3
CVE-2024-1910unauthenticated · needs a click≤ 1.0.7.4
Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory
- Medium 4.3
CVE-2024-1909unauthenticated · needs a click≤ 1.0.7.4
Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory
- Medium 4.3
CVE-2024-1907unauthenticated · needs a click≤ 1.0.7.4
Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory
- Medium 4.3
CVE-2024-1906unauthenticated · needs a click≤ 1.0.7.4
Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory
- Medium 4.3
CVE-2025-59005login requiredno fix seen
WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability
- Medium 4.3
CVE-2024-0385subscriber+≤ 1.0.7.4
Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory
- Medium 4.3
CVE-2024-1653subscriber+≤ 1.0.7.4
Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition
- Medium 4.3
CVE-2024-1652subscriber+≤ 1.0.7.4
Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory
- Medium 4.3
CVE-2024-1650subscriber+≤ 1.0.7.4
Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory
- Medium 4.3
CVE-2024-1649subscriber+≤ 1.0.7.4
Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS). The record lists the latest wordpress.org release (1.0.7.5) as affected.