A missing capability check in the taxopress_ai_add_post_term function lets users with Contributor-level access and higher add or delete tags and categories on any WordPress post, even those they do not own. This flaw allows an attacker to alter content classification, influence search engine visibility, and potentially misdirect users. The vulnerability does not grant code execution or full system compromise, but it disrupts content integrity and trust.

The issue affects the stevejburge WordPress plugin "Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI" in all releases up to and including version 3.41.0. Site administrators running any of these plugin versions are susceptible.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An authenticated user on a WordPress site who holds a Contributor role or higher can exploit the vulnerability simply by using the normal plugin interface or by constructing a crafted request to the taxopress AI Ajax endpoint. No additional conditions or elevated privileges are required beyond those granted by the standard Contributor capability.