The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress suffers from an authorization bypass vulnerability (CWE-862) in the taxopress_merge_terms_batch function. This vulnerability allows authenticated users with minimal privileges (subscriber level and above) to perform unauthorized actions such as merging or deleting taxonomy terms. The plugin does not adequately verify that the user is authorized to perform these actions, leading to potential unauthorized modification of taxonomy data. The vulnerability affects all versions up to and including 3.40.1. The CVSS 3.1 base score is 4.3 (medium severity), with network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No patch or remediation details are provided in the available data.

An authenticated user with subscriber-level privileges or higher can bypass authorization controls to merge or delete arbitrary taxonomy terms within the plugin. This could lead to unauthorized modification of taxonomy data, potentially affecting site content organization or categorization. There is no impact on confidentiality or availability, and integrity impact is low. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, minimizing subscriber-level user access where possible. Monitor plugin updates from the vendor for a security patch addressing this authorization bypass vulnerability.