Listen to this Post
The CVE-2025-13354 vulnerability in the Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress stems from an authorization bypass in the ‘taxopress_merge_terms_batch’ function. This function handles requests to merge or delete taxonomy terms but fails to implement proper capability checks. Specifically, it does not verify if the authenticated user has permissions like ‘manage_categories’ before processing actions. The plugin’s AJAX or admin endpoints expose this function without using WordPress’s standard nonce or authorization hooks. Consequently, any authenticated user, including those with subscriber-level privileges, can craft HTTP POST requests to these endpoints. By supplying parameters such as ‘action’ set to ‘taxopress_merge_terms_batch’ and including term IDs or delete commands, attackers can trigger unauthorized operations. This allows them to merge arbitrary terms, disrupting site taxonomies, or delete terms, leading to content loss and structural damage. The vulnerability affects all plugin versions up to 3.40.1, enabling privilege escalation where low-level users perform admin tasks. The flaw is particularly critical in multisite setups where taxonomy changes propagate network-wide, amplifying impact.
Platform: WordPress Plugin
Version: Up to 3.40.1
Vulnerability: Authorization Bypass
Severity: Critical
Date: 12/03/2025
Prediction: Patch expected 12/10/2025
What Undercode Say:
Analytics
Showing bash commands and codes related to the blog
how Exploit:
Protection from this CVE
Impact:
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
