What is the CVSS score of EUVD-2026-24670?

EUVD-2026-24670 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

TP Restore Categories And Taxonomies EUVD-2026-24670

| CVE-2026-4128 MEDIUM

Missing Authorization (CWE-862)

2026-04-22 Wordfence

PHP Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:01 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24670

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.

AnalysisAI

TP Restore Categories And Taxonomies WordPress plugin versions up to 1.0.1 lack capability checks in the delete_term() AJAX handler, allowing authenticated Subscriber-level users to permanently delete taxonomy terms from backup tables by reusing a nonce exposed to all authenticated users. The vulnerability bypasses authorization despite nonce validation, enabling low-privileged attackers to cause data loss via a simple crafted AJAX request.

Technical ContextAI

The plugin registers a delete_term() function to handle the 'tpmcatpt_delete_term' AJAX action without checking user capabilities via current_user_can(). While the code does validate a nonce using check_ajax_referer(), this nonce is generated for all authenticated users during the admin_enqueue_scripts hook and exposed globally on every wp-admin page accessible to Subscriber-level roles (including profile.php). This is a classic Missing Authorization vulnerability (CWE-862) where authentication exists but authorization does not. The vulnerability affects the WordPress plugin ecosystem where role-based access control is paramount; Subscriber is the lowest privilege level above unauthenticated guests. The CPE identifier cpe:2.3:a:tplugins:tp_restore_categories_and_taxonomies:*:*:*:*:*:*:*:* confirms all versions through 1.0.1 are vulnerable.

RemediationAI

Upgrade TP Restore Categories And Taxonomies plugin to version 1.0.2 or later, which should include proper capability checks (e.g., current_user_can('manage_categories') or equivalent) before executing delete_term(). For immediate protection pending patching, restrict wp-admin access to trusted users only via WordPress role management or Web Application Firewall rules; specifically deny the 'tpmcatpt_delete_term' AJAX action from Subscriber and Contributor roles using a security plugin that can hook into wp_ajax_* actions and verify capabilities. Alternatively, deactivate the plugin if term backup/restore functionality is not actively used. Site administrators should audit deleted terms after patching to identify any unauthorized deletions during the vulnerable window. References: Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/53a0749f-86e9-4f62-9de2-a6759c78ba2f.