Technical impact
The TaxoPress "Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI" plugin contains an authorization bypass in the "taxopress_merge_terms_batch" function. The missing authorization check (CWE‑862) allows an authenticated user who has subscriber rights or higher to merge or delete taxonomy terms that they normally would not be permitted to alter. This elevation of privilege can corrupt content classification, disrupt site navigation, and undermine the integrity of the WordPress taxonomy system.
Affected Systems
WordPress installations running the TaxoPress plugin version 3.40.1 or earlier are impacted. The vulnerability is not present in versions newer than 3.40.1, and the issue applies to all supported WordPress versions that host the affected plugin.
Risk and Exploitability
The CVSS base score of 4.3 indicates moderate risk, while an EPSS score of less than 1 percent shows that exploitation attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalog. An attacker would need legitimate subscriber level credentials to perform the bypass and manipulate taxonomy terms, so the attack vector is largely confined to authenticated site use. The lack of network or remote code execution vectors reduces the likelihood of widespread compromise.
