Tag Category And Taxonomy Manager
Monthly
Insecure Direct Object Reference (IDOR) in the Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 allows authenticated contributors to disclose content from private or draft posts they do not own. The plugin fails to verify post ownership before processing a referenced post ID and returning derived data, enabling a contributor to enumerate and extract information from restricted content authored by other users. No public exploitation in the wild has been confirmed (no CISA KEV listing), though WPScan has published a publicly available proof-of-concept.
Insecure Direct Object Reference (IDOR) in the Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 allows authenticated contributors to disclose content from private or draft posts they do not own. The plugin fails to verify post ownership before processing a referenced post ID and returning derived data, enabling a contributor to enumerate and extract information from restricted content authored by other users. No public exploitation in the wild has been confirmed (no CISA KEV listing), though WPScan has published a publicly available proof-of-concept.