CVE-2021-24788: Incorrect Authorization

The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user including simple subscribers can add/set/delete arbitrary categories to posts...

PT-2021-16282

Name of the Vulnerable Software and Affected Versions: Batch Cat WordPress plugin versions 0.3 and earlier Description: The issue allows any authenticated user, including simple subscribers, to add, set, or delete arbitrary categories to posts. This is because the plugin defines 3 custom AJAX...