The vulnerability is a classic IDOR that allows a contributor to view private or draft posts that are not owned by them. The plugin does not check if the current user has permission to access the referenced post before returning data generated from it, leading to unauthorized data disclosure. This flaw can expose confidential or proprietary content to users who are not trusted with it.

WordPress sites that have the Tag, Category, and Taxonomy Manager plugin installed in a version older than 3.51.0 are affected. The issue applies to any installation where contributors have been granted the default or custom contributor role and is not limited by site configuration.

The flaw requires the attacker to possess a contributor role and to know or guess the ID of a private or draft post. No technical barrier prevents exploitation beyond the usual plugin interface, so a skilled user can obtain the data via simple HTTP requests to the plugin’s endpoints. The lack of an EPSS score and KEV listing means exploitation probability is uncertain, but the CVE’s nature suggests moderate to high risk for sites that rely on strict authorship controls. No mitigations other than updating the plugin are listed in the CNA documentation, so the vulnerability remains available to any authenticated contributor.