CVE-2026-4128
Missing Authorization in TP Restore Categories WordPress Plugin Allows Term Deletion
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp_restore_categories_and_taxonomies | plugin | to 1.0.1 (inc) |
| wordfence | tp_restore_categories_and_taxonomies | to 1.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users with low-level access (Subscriber-level) to delete taxonomy term records without proper authorization checks. This unauthorized deletion of data could potentially lead to issues with data integrity and control.
However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The TP Restore Categories And Taxonomies plugin for WordPress has a vulnerability called Missing Authorization in all versions up to and including 1.0.1. Specifically, the delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not check if the user has the necessary permissions to delete taxonomy term records.
Although the function verifies a nonce via check_ajax_referer(), this nonce is generated for all authenticated users and is exposed on any wp-admin page, including pages accessible by low-privilege users such as Subscribers.
This means that any authenticated user with Subscriber-level access or higher can send a specially crafted AJAX request with a valid nonce and an arbitrary term_id to permanently delete taxonomy term records from the plugin's trash or backup tables.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with low-level access (Subscriber or above) to delete taxonomy term records without proper authorization.
The impact is limited to integrity, as the attacker can cause loss of taxonomy term data by permanently deleting terms from the plugin's trash or backup tables.
The CVSS score of 4.3 indicates a low to medium severity, with no impact on confidentiality or availability, but with some impact on integrity.