Description
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).
Published: 2025-12-03
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authenticated SQL injection enabling database data extraction
Action: Patch immediately
AI Analysis

Impact

The vulnerability lies in the getTermsForAjax function of the Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin. Insufficient escaping of user-supplied parameters and the lack of prepared statements allow attackers to inject additional SQL clauses into existing queries via a time-based technique. This can be used to pull sensitive information from the WordPress database. The weakness corresponds to CWE-89.

Affected Systems

All releases of the TaxoPress Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin up to and including version 3.40.1 are affected. The plugin is maintained by stevejburge and runs on WordPress; contributors or higher roles who have the default metabox access for taxonomies can trigger the flaw.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium-severity flaw, and the EPSS score of < 1% suggests a low probability of exploitation at this time. The attack requires authenticated access at contributor level or higher and utilizes the AJAX endpoint, making it a low-latency, time-based injection. Although the vulnerability is not listed in the CISA KEV catalog, the potential for database compromise warrants immediate attention.

Generated by OpenCVE AI on April 21, 2026 at 01:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the TaxoPress plugin to a version newer than 3.40.1, which contains the proper escaping and query preparation for the getTermsForAjax call.
  • If an update is not yet available, restrict AJAX access to administrators only or temporarily disable the getTermsForAjax endpoint for contributors by adjusting the plugin’s settings or adding custom code to block the route.
  • As a temporary workaround, remove or revoke the contributor metabox access to taxonomy terms so that the insecure AJAX request cannot be made.

Generated by OpenCVE AI on April 21, 2026 at 01:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 05 Dec 2025 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Taxopress
Taxopress taxopress
CPEs cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:*
Vendors & Products Taxopress
Taxopress taxopress

Thu, 04 Dec 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Wed, 03 Dec 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 03 Dec 2025 14:00:00 +0000

Type Values Removed Values Added
Description The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).
Title Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Taxopress Taxopress
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:27:12.752Z

Reserved: 2025-11-18T15:56:36.915Z

Link: CVE-2025-13359

cve-icon Vulnrichment

Updated: 2025-12-03T14:13:47.963Z

cve-icon NVD

Status : Analyzed

Published: 2025-12-03T14:15:47.890

Modified: 2025-12-05T18:37:12.593

Link: CVE-2025-13359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T01:15:20Z

Weaknesses