The vulnerability is an IDOR that allows a contributor to view private or draft posts that they do not own. The Tag, Category, and Taxonomy Manager plugin does not verify that the current user has permission to access the referenced post before returning derived data, leading to unauthorized data disclosure. This flaw reflects CWE-639 (Privilege Confusion) and can expose confidential or proprietary content to users who are not trusted with it.

WordPress sites that have the Tag, Category, and Taxonomy Manager plugin installed in a version older than 3.51.0 are affected. The issue applies to any installation where contributors have been granted the default or custom contributor role and is not limited by site configuration.

The CVSS score of 2.7 indicates a low severity. The flaw requires the attacker to possess a contributor role and to know or guess the ID of a private or draft post. No technical barrier prevents exploitation beyond the usual plugin interface, so a skilled user can obtain the data via simple HTTP requests to the plugin’s endpoints. The EPSS score of < 1% indicates a low exploitation probability, and it is not listed in KEV. Based on the available data, it is inferred that the data disclosure could be problematic for sites that rely on strict authorship controls.