CVE-2026-15231

Received Received - Intake

Unauthorized Post Data Exposure in Tag, Category, and Taxonomy Manager WordPress Plugin

Publication date: 2026-08-03

Last updated on: 2026-08-04

Assigner: WPScan

Description

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-04

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-15231

EUVD

EUVD-2026-52172

Affected Vendors & Products

Vendor	Product	Version / Range
tag_category_and_taxonomy_manager	tag_category_and_taxonomy_manager	to 3.51.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Tag, Category, and Taxonomy Manager WordPress plugin before version 3.51.0. It allows users with contributor-level access to view private or draft posts they do not own by exploiting improper authorization checks when processing post references.

Detection Guidance

This vulnerability requires checking WordPress plugin versions and user privileges. Inspect the Tag, Category, and Taxonomy Manager plugin version on your WordPress site. If it is below 3.51.0, it is vulnerable. Additionally, review user roles to ensure contributors cannot access restricted post data.

Impact Analysis

If you use this plugin, an attacker with contributor access could access sensitive data from private or draft posts, leading to unauthorized information disclosure. This could expose confidential content, user data, or other sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or protected health information. Unauthorized access to private data may result in legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Update the Tag, Category, and Taxonomy Manager WordPress plugin to version 3.51.0 or later to address the authorization flaw.

Hi! I’m here to help you understand CVE-2026-15231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70