EUVD-2026-52172
GHSA-2fw4-4h2j-gcmv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor is a low-privilege authenticated role in WordPress, making PR:L more accurate than the official PR:H; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 allows authenticated contributors to disclose content from private or draft posts they do not own. The plugin fails to verify post ownership before processing a referenced post ID and returning derived data, enabling a contributor to enumerate and extract information from restricted content authored by other users. No public exploitation in the wild has been confirmed (no CISA KEV listing), though WPScan has published a publicly available proof-of-concept.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key), a class of IDOR flaw where an application accepts a user-supplied identifier - in this case, a post ID - and performs backend processing without verifying that the requesting user is authorized to access the referenced resource. The affected product is the 'Tag, Category, and Taxonomy Manager' WordPress plugin (CPE: cpe:2.3:a:unknown:tag,_category,_and_taxonomy_manager:*:*:*:*:*:*:*:*), all versions before 3.51.0. In WordPress, the Contributor role is permitted to create posts in draft form but cannot publish or view others' private/draft content - this plugin bypasses that boundary by trusting the client-supplied post ID without an authorization check, effectively leaking controlled content through the plugin's data-processing response.
RemediationAI
Update the Tag, Category, and Taxonomy Manager plugin to version 3.51.0 or later, which resolves the missing authorization check on post ID references. The fix is confirmed available from the vendor per the WPScan report (https://wpscan.com/vulnerability/5980ab15-bc6e-4298-9d0c-92c17217ec2c/). As a compensating control prior to patching, site administrators can restrict the Contributor role from being assigned to untrusted users, effectively raising the bar for exploitation; however, this does not eliminate the flaw and carries the trade-off of reducing editorial workflow capability. Disabling the plugin entirely is a zero-risk workaround if taxonomy management features are not actively needed, with the obvious trade-off of losing that functionality. Monitoring for anomalous requests to plugin endpoints referencing post IDs not owned by the authenticated user may assist in detection.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today