PT-2025-49327 · WordPress · Tag

Dmitry Ignatyev · Published 2025-12-06 · Updated 2025-12-06 · CVE-2025-13922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress versions through 3.40.1

Description The software contains a time-based blind SQL Injection issue due to insufficient escaping of user-supplied parameters and a lack of SQL query parameterization. This allows authenticated attackers with Contributor-level access or higher, possessing AI metabox permissions, to inject additional SQL queries into existing database queries. This can lead to the extraction of sensitive information, performance degradation, or data inference through time-based techniques. The vulnerable parameter is existing terms orderby within the AI preview AJAX endpoint.

Recommendations Update to a version beyond 3.40.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13922

Affected Products

Tag

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13922 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f40cc632-c6af-4c8b-a455-76319f7fe151?source=cve · Note
• https://research.cleantalk.org/cve-2025-13922 · Note
• https://t.me/cveNotify/144997 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3408243%40simple-tags%2Ftrunk&old=3388829%40simple-tags%2Ftrunk&sfp_email=&sfph_mail=#file17 · Note
• https://plugins.trac.wordpress.org/browser/simple-tags/tags/3.40.1/inc/class.admin.php#L1406 · Note
• https://plugins.trac.wordpress.org/browser/simple-tags/tags/3.40.1/modules/taxopress-ai/classes/TaxoPressAiAjax.php#L180 · Note
• https://twitter.com/CVEnew/status/1997167491622056021 · Twitter Post