PT-2026-34291 · Ht Plugins · Tp Restore Categories/Taxonomies

Nabil Irawan · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-4128

NVD

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete term() function, which handles the 'tpmcattt delete term' AJAX action, does not perform any capability check (e.g., current user can()) to verify the user has sufficient permissions. While it does verify a nonce via check ajax referer(), this nonce is generated for all authenticated users via the admin enqueue scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term id.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4128

Affected Products

Tp Restore Categories/Taxonomies

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4128 · Security Note
• https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/trunk/includes/class-tp-move-categories-and-taxonomies-to-trash.php#L169 · Note
• https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/tags/1.0.1/admin/class-tp-move-categories-and-taxonomies-to-trash-admin.php#L474 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/53a0749f-86e9-4f62-9de2-a6759c78ba2f?source=cve · Note
• https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/tags/1.0.1/includes/class-tp-move-categories-and-taxonomies-to-trash.php#L169 · Note
• https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/trunk/admin/class-tp-move-categories-and-taxonomies-to-trash-admin.php#L474 · Note