The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress contains a SQL injection vulnerability in the post_types parameter. In versions up to 3.40.0, the parameter is not properly escaped, allowing an authenticated user with Editor privileges or higher to inject additional SQL clauses. Successful exploitation could lead to unauthorized extraction of database content, compromising confidentiality of site data.

The vulnerability affects the WordPress plugin Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI developed by stevejburge. All releases up to and including 3.40.0 are impacted; newer versions may have resolved the issue. The only required condition is that the attacker has authenticated Editor-level access on the WordPress installation.

The CVSS score of 4.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, reinforcing that it has not been publicly exploited to date. An attacker would need legitimate access, making internal threat actors or compromised accounts the most likely vectors. Mitigation by updating the plugin is the recommended course of action.