CVE-2025-13922 is a medium severity SQL Injection vulnerability (CWE-89) in the Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI WordPress plugin. The flaw exists in the 'existing_terms_orderby' parameter of the AI preview AJAX endpoint due to improper neutralization of special elements in SQL commands. Authenticated users with Contributor-level privileges and AI metabox permissions can exploit this to append malicious SQL queries, enabling data extraction or performance impacts via time-based blind SQL Injection. The vulnerability affects all versions up to and including 3.40.1. No patch or official remediation guidance is currently available from the vendor, and no known exploits have been observed.

Successful exploitation allows authenticated users with Contributor-level access and AI metabox permissions to perform time-based blind SQL Injection attacks. This can lead to unauthorized disclosure of sensitive database information and potential performance degradation of the affected system. The vulnerability does not impact availability or integrity directly but compromises confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and partial privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level user permissions and AI metabox access to trusted users only. Monitor for updates from the plugin vendor and apply patches promptly once available. Consider disabling or limiting the use of the AI preview AJAX endpoint if feasible.