The AutoCatSet WordPress plugin suffers from a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in the autocatset_ajax function. A malicious actor can craft a forged request that an authenticated site administrator unknowingly submits, triggering automatic recategorization of posts. This flaw allows the attacker to change post categories.

All installations of gyaku AutoCatSet for WordPress with version 2.1.4 or earlier are affected. No specific patch versions are listed, but remediation requires updating beyond 2.1.4.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the flaw can be exploited by any attacker who manages to deceive an authenticated administrator—most likely through social engineering or a malicious link—into opening a forged request. This attack vector relies only on the victim’s authenticated session, making it a low‑effort but purely human‑centric method of attack.