The vulnerability is a missing authorization flaw that allows improper access to the plugin’s protected functions. Because the access control security levels are incorrectly configured, a user who should not have permissions can potentially view or modify content, change settings, or perform other privileged actions through the Categorify plugin. This flaw is classified as CWE‑862, indicating unauthorized access to normally protected resources.

The issue affects WordPress users who have installed the Frenify Categorify plugin up to and including version 1.0.7.5. No other products or vendor releases are affected as per the current CNA listing.

The CVSS score of 4.3 places the vulnerability in the moderate range, and the EPSS score of less than 1 % indicates a very low probability of being exploited in the wild. The flaw can be triggered by accessing the plugin’s functional endpoints, potentially without authentication or with only low‑privileged credentials, depending on the site’s configuration. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation campaigns targeting it at this time.