CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.
Explanation of Vulnerability in Simple Terms
The Tag, Category, and Taxonomy Manager plugin for WordPress contains a missing authorization check that allows authenticated users with low privileges to modify taxonomy data they should not have access to. The vulnerability affects all versions up to 3.41.0. An attacker with a basic user account can alter taxonomy settings without proper permission validation. Update to a version newer than 3.41.0 to resolve this issue.
What an attacker can do
Modify taxonomy data and settings without proper authorization.
Potential impact on your site
Unauthorized users can alter your site's categories, tags, and taxonomy structure, potentially disrupting content organization.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Contributor or Subscriber).
Key dates
External resources
