The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on ...
Date: 2026-01
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-10874
CVE-2024-11896
CVE-2025-11972
CVE-2025-12973
CVE-2025-13354
CVE-2025-13359
CVE-2025-13922
CVE-2025-14371
CVE-2025-14980
CVE-2025-6716
CVE-2025-7725
CVE-2026-6393
CVE-2026-6711
CVE-2026-6712
CWE: CWE-200
CWE-434
CWE-79
CWE-862
CWE-89
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.


Mitigations:

Architectural layers (MAESTRO):