CVE-2025-13354

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/TaxoPress/TaxoPress/commit/5eb2cee861ebd109152eea968aca0259c078c8b0	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/05c1ee52-02c9-440b-9269-14ea8b73be45?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:*

History

18 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) El Gestor de Etiquetas, Categorías y Taxonomías - Autotagger de IA con plugin de OpenAI para WordPress es vulnerable a un bypass de autorización en todas las versiones hasta la 3.40.1, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario esté autorizado para realizar una acción en la función “taxopress_merge_terms_batch”. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, fusionen o eliminen términos de taxonomía arbitrarios.

Information

Published : 2025-12-03 14:15

Updated : 2026-10-18 17:10

NVD link : CVE-2025-13354

Mitre link : CVE-2025-13354

CVE.ORG link : CVE-2025-13354

JSON object : View

Products Affected

taxopress

taxopress

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-13354", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13354", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T14:50:34.638149Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "stevejburge", "product": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.40.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-03T14:15:46.930", "references": [{"url": "https://github.com/TaxoPress/TaxoPress/commit/5eb2cee861ebd109152eea968aca0259c078c8b0", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05c1ee52-02c9-440b-9269-14ea8b73be45?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the \"taxopress_merge_terms_batch\" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms."}, {"lang": "es", "value": "El Gestor de Etiquetas, Categor\u00edas y Taxonom\u00edas - Autotagger de IA con plugin de OpenAI para WordPress es vulnerable a un bypass de autorizaci\u00f3n en todas las versiones hasta la 3.40.1, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e9 autorizado para realizar una acci\u00f3n en la funci\u00f3n \u201ctaxopress_merge_terms_batch\u201d. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, fusionen o eliminen t\u00e9rminos de taxonom\u00eda arbitrarios."}], "lastModified": "2026-10-18T17:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "CE8412F8-3636-4267-8AF5-D87CF86ADEC2", "versionEndExcluding": "3.41.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}