PT-2025-48808 · WordPress · Tag

Published 2025-12-03 · Updated 2025-12-05 · CVE-2025-13359

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress versions through 3.40.1

Description The software is susceptible to a time-based SQL Injection issue via the getTermsForAjax function. This is a result of inadequate escaping of user-provided parameters and insufficient preparation of the existing SQL query. Authenticated attackers with contributor-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database, provided they have metabox access for the taxonomy, which is enabled by default for contributors.

Recommendations Versions prior to and including 3.40.1 are affected. Update to a version beyond 3.40.1 when available. As a temporary workaround, restrict access to the getTermsForAjax function for users with contributor-level access or below.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13359

Affected Products

Tag

References · 8

• https://github.com/TaxoPress/TaxoPress/commit/1097a22181aa10ce55cc9cd5fa8495f7494e18ea · Patch
• https://osv.dev/vulnerability/CVE-2025-13359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13359 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d9bebdc0-1625-4dc4-8c92-37f379868cd5?source=cve · Note
• https://twitter.com/dailycve/status/1997051652465922235 · Twitter Post
• https://t.me/cveNotify/144611 · Telegram Post
• https://t.me/CVEtracker/38749 · Telegram Post
• https://t.me/cveNotify/144925 · Telegram Post