CVE-2025-13359

{"id": "CVE-2025-13359", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13359", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T14:13:44.239329Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "stevejburge", "product": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.40.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-03T14:15:47.890", "references": [{"url": "https://github.com/TaxoPress/TaxoPress/commit/1097a22181aa10ce55cc9cd5fa8495f7494e18ea", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9bebdc0-1625-4dc4-8c92-37f379868cd5?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "The Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the \"getTermsForAjax\" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors)."}, {"lang": "es", "value": "El plugin \u201cTag, Category, and Taxonomy Manager - AI Autotagger with OpenAI\u201d para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s de la funci\u00f3n \u201cgetTermsForAjax\u201d en todas las versiones hasta la 3.40.1, inclusive. Esto se debe a un escape insuficiente en los par\u00e1metros proporcionados por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, puedan a\u00f1adir consultas SQL adicionales a consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos, siempre que tengan acceso a la metabox para la taxonom\u00eda (habilitado por defecto para los colaboradores)."}], "lastModified": "2026-10-18T17:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "CE8412F8-3636-4267-8AF5-D87CF86ADEC2", "versionEndExcluding": "3.41.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}