CVE-2026-4128

TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action

View on CVE.org

Published Apr 22, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.

Analysis

Technical impact

The TP Restore Categories And Taxonomies plugin for WordPress fails to enforce sufficient permissions when processing the tpmcattt_delete_term AJAX action. Although a nonce is verified, it is generated for all authenticated users and can be retrieved from any wp-admin page, including those accessible by Subscribers. Consequently, authorized users with Subscriber or higher privileges can send a crafted request to permanently delete taxonomy terms from the plugin’s backup tables, effectively removing categorized content without appropriate approval.

Affected Systems

This issue affects the WordPress plugin TP Restore Categories And Taxonomies in all releases up to and including version 1.0.1. Users running any of these versions on a WordPress installation are potentially exposed to the vulnerability.

Risk and Exploitability

The CVSS score of 4.3 places this vulnerability in the moderate range. No EPSS data is available and it is not listed in the CISA KEV catalog. An attacker needs only a valid subscriber‑level account and the ability to interact with the site's wp-admin area to obtain the nonce, after which a simple AJAX request can delete taxonomy records. The lack of a capability check and the universal availability of the nonce make exploitation straightforward for any authenticated user.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

tplugins

TP Restore Categories And Taxonomies

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.1

No data.

Vendor Product Versions

Tplugins

Tp Restore Categories And Taxonomies

Version	Status	Scheme	Platform
`[0,1.0.1]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the TP Restore Categories And Taxonomies plugin to a version that implements a capability check for taxonomy deletion actions.
If an upgrade is not immediately possible, disable or remove the tpmcattt_delete_term AJAX handler for Subscriber and lower roles, ensuring that only administrators can trigger delete operations.
Reduce the permissions granted to Subscriber users by revoking their ability to access or view pages that expose the AJAX nonce, such as profile.php, or by configuring role‑based access control to limit their access to wp-admin.

Generated by OpenCVE AI on April 22, 2026 at 09:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.245% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/tags/1.0.1/admin/class-tp-move-categories-and-taxonomies-to-trash-admin.php#L474
https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/tags/1.0.1/includes/class-tp-move-categories-and-taxonomies-to-trash.php#L169
https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/trunk/admin/class-tp-move-categories-and-taxonomies-to-trash-admin.php#L474
https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/trunk/includes/class-tp-move-categories-and-taxonomies-to-trash.php#L169
https://www.wordfence.com/threat-intel/vulnerabilities/id/53a0749f-86e9-4f62-9de2-a6759c78ba2f?source=cve

History

Apr 22, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Tplugins Tplugins tp Restore Categories And Taxonomies Wordpress Wordpress wordpress
Vendors & Products		Tplugins Tplugins tp Restore Categories And Taxonomies Wordpress Wordpress wordpress

Apr 22, 2026 8:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.
Title		TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/tags/1.0.1/admin/class-tp-move-categories-and-taxonomies-to-trash-admin.php#L474 https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/tags/1.0.1/includes/class-tp-move-categories-and-taxonomies-to-trash.php#L169 https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/trunk/admin/class-tp-move-categories-and-taxonomies-to-trash-admin.php#L474 https://plugins.trac.wordpress.org/browser/tp-restore-categories-and-taxonomies/trunk/includes/class-tp-move-categories-and-taxonomies-to-trash.php#L169 https://www.wordfence.com/threat-intel/vulnerabilities/id/53a0749f-86e9-4f62-9de2-a6759c78ba2f?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`