What is the CVSS score of CVE-2026-74012?

CVE-2026-74012 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of TaxoPress are affected by CVE-2026-74012?

TaxoPress WordPress plugin versions 3.51.0 and earlier contain a PHP object injection vulnerability requiring authenticated access; no public exploit has been identified at time of analysis, but…

How to fix or mitigate CVE-2026-74012?

Within 24 hours: audit all WordPress installations to identify TaxoPress usage and confirm running versions; immediately disable and remove TaxoPress plugin version 3.51.0 or earlier from production environments. Within 7 days: evaluate alternative WordPress taxonomy management plugins and plan migration timelines; restrict WordPress editor-level role assignments to essential, trusted personnel only as a temporary compensating control. Within 30 days: complete removal of vulnerable TaxoPress versions from all environments, conduct comprehensive security review of affected WordPress instances for unauthorized modifications or data exfiltration indicators, and implement enhanced access logging for WordPress administrative functions.

TaxoPress CVE-2026-74012

EUVD-2026-60818 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-wrmm-h8g9-2g7g

PHP WordPress Deserialization Taxopress Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible WordPress editor exploitable by any authenticated low-privilege user; full C/I/A impact achievable via deserialization POP chain with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 14:52 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

HIGH 8.8

DescriptionCVE.org

Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.

AnalysisAI

PHP Object Injection in TaxoPress versions up to and including 3.51.0 enables authenticated low-privileged WordPress users to inject malicious serialized PHP objects through the plugin's editor interface. When a suitable Property-Oriented Programming (POP) gadget chain is present in the target WordPress environment, this can escalate to full remote code execution, unauthorized file writes, or complete site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 High rating reflects the severe potential impact achievable with low authentication requirements.

Technical ContextAI

TaxoPress (formerly Simple Tags) is a WordPress plugin developed by steve_burge for managing taxonomies, tags, and content categories. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin's editor component passes user-controlled input to PHP's native unserialize() function without sufficient sanitization or integrity validation. PHP deserialization flaws are particularly dangerous because they allow attackers to instantiate arbitrary PHP class objects and invoke their magic methods (__wakeup, __destruct, __toString, etc.), potentially constructing a POP chain that redirects normal execution flow into attacker-controlled code paths. The impact is environment-dependent - the richness of available gadget classes drawn from WordPress core, themes, or co-installed plugins determines whether injection translates to code execution. All versions through 3.51.0 are affected per CPE cpe:2.3:a:steve_burge:taxopress:*:*:*:*:*:*:*:*.

RemediationAI

Update TaxoPress to the version released after 3.51.0 by consulting the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simple-tags/vulnerability/wordpress-taxopress-plugin-3-51-0-php-object-injection-vulnerability) or the WordPress plugin repository changelog, as the exact patched release version is not independently confirmed in the available reference data. As a compensating control pending patching, restrict contributor, author, and editor role assignments strictly to trusted accounts, since exploitation requires PR:L authenticated access - this eliminates the attack surface for sites with open user registration. Deploying a WAF rule that blocks or sanitizes serialized PHP payloads (strings beginning with recognized PHP serialization signatures such as O:, a:, s:) in POST body parameters can reduce exploitability, though this may produce false positives if the plugin legitimately serializes data through the same interface. Temporarily deactivating the TaxoPress plugin is the most reliable interim mitigation where patching is not immediately feasible, at the cost of taxonomy management functionality until the patch is applied.