CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.
Explanation of Vulnerability in Simple Terms
The Tag, Category, and Taxonomy Manager plugin for WordPress contains a missing authorization check that allows authenticated users with low privileges to modify taxonomy data they should not have access to. An attacker with a basic user account can alter categories or tags without proper permission validation. The vulnerability affects all versions up to 3.40.1 and has low integrity impact.
What an attacker can do
Modify taxonomy data (tags, categories) without proper authorization checks.
Potential impact on your site
Unauthorized users can alter your site's taxonomy structure, potentially corrupting content organization and SEO metadata.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Contributor or Subscriber role).
Key dates
External resources
