WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
https://wpvulndb.com/vulnerabilities/8520
https://wordpress.org/news/2016/06/wordpress-4-5-3/
https://codex.wordpress.org/Version_4.5.3
http://www.securitytracker.com/id/1036163