Executive Summary

The TP Restore Categories And Taxonomies plugin for WordPress has a vulnerability called Missing Authorization in all versions up to and including 1.0.1. Specifically, the delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not check if the user has the necessary permissions to delete taxonomy term records.

Although the function verifies a nonce via check_ajax_referer(), this nonce is generated for all authenticated users and is exposed on any wp-admin page, including pages accessible by low-privilege users such as Subscribers.

This means that any authenticated user with Subscriber-level access or higher can send a specially crafted AJAX request with a valid nonce and an arbitrary term_id to permanently delete taxonomy term records from the plugin's trash or backup tables.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users with low-level access (Subscriber or above) to delete taxonomy term records without proper authorization.

The impact is limited to integrity, as the attacker can cause loss of taxonomy term data by permanently deleting terms from the plugin's trash or backup tables.

The CVSS score of 4.3 indicates a low to medium severity, with no impact on confidentiality or availability, but with some impact on integrity.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users with low-level access (Subscriber-level) to delete taxonomy term records without proper authorization checks. This unauthorized deletion of data could potentially lead to issues with data integrity and control.

However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0