PT-2025-48807 · WordPress · Tag

Published 2025-12-03 · Updated 2025-12-05 · CVE-2025-13354

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress versions through 3.40.1

Description The software is susceptible to authorization bypass due to improper verification of user authorization within the taxopress merge terms batch function. This allows authenticated attackers with subscriber-level access or higher to merge or delete arbitrary taxonomy terms.

Recommendations Versions prior to and including 3.40.1 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13354

Affected Products

Tag

References · 8

• https://github.com/TaxoPress/TaxoPress/commit/5eb2cee861ebd109152eea968aca0259c078c8b0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-13354 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13354 · Vendor Advisory
• https://t.me/cveNotify/144924 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/05c1ee52-02c9-440b-9269-14ea8b73be45?source=cve · Note
• https://twitter.com/dailycve/status/1997051457489547643 · Twitter Post
• https://t.me/cveNotify/144610 · Telegram Post
• https://t.me/CVEtracker/38748 · Telegram Post