Executive Summary

This vulnerability exists in the Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress, where the plugin fails to properly verify user authorization in the "taxopress_merge_terms_batch" function. As a result, authenticated users with subscriber level access or higher can bypass authorization controls to merge or delete arbitrary taxonomy terms.

Useful 0 Not Useful 0

Impact Analysis

An attacker with subscriber level access or above can exploit this vulnerability to merge or delete arbitrary taxonomy terms, potentially disrupting the organization and categorization of content within the WordPress site. This could lead to content mismanagement or loss of important taxonomy data.

Useful 0 Not Useful 0