CVE-2026-4128: CWE-862 Missing Authorization in tplugins TP Restore Categories And Taxonomies
The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.
AI Analysis
Technical Summary
CVE-2026-4128 describes a missing authorization vulnerability (CWE-862) in the TP Restore Categories And Taxonomies WordPress plugin versions up to 1.0.1. The vulnerability arises because the delete_term() function handling the 'tpmcattt_delete_term' AJAX action lacks a capability check such as current_user_can(). While it performs a nonce verification, the nonce is generated for all authenticated users and exposed on any wp-admin page, including those accessible by subscribers. Consequently, any authenticated user with Subscriber-level privileges or higher can send a crafted AJAX request with a valid nonce and arbitrary term_id to permanently delete taxonomy term records from the plugin's trash or backup tables.
Potential Impact
The vulnerability allows authenticated users with minimal privileges (Subscriber-level and above) to delete taxonomy term records from the plugin's trash or backup tables without proper authorization. This impacts the integrity of taxonomy data managed by the plugin but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact confined to integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor addressing this missing authorization issue.
CVE-2026-4128: CWE-862 Missing Authorization in tplugins TP Restore Categories And Taxonomies
Description
The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4128 describes a missing authorization vulnerability (CWE-862) in the TP Restore Categories And Taxonomies WordPress plugin versions up to 1.0.1. The vulnerability arises because the delete_term() function handling the 'tpmcattt_delete_term' AJAX action lacks a capability check such as current_user_can(). While it performs a nonce verification, the nonce is generated for all authenticated users and exposed on any wp-admin page, including those accessible by subscribers. Consequently, any authenticated user with Subscriber-level privileges or higher can send a crafted AJAX request with a valid nonce and arbitrary term_id to permanently delete taxonomy term records from the plugin's trash or backup tables.
Potential Impact
The vulnerability allows authenticated users with minimal privileges (Subscriber-level and above) to delete taxonomy term records from the plugin's trash or backup tables without proper authorization. This impacts the integrity of taxonomy data managed by the plugin but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact confined to integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor addressing this missing authorization issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-13T14:11:25.304Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e8876e19fe3cd2cd808e5f
Added to database: 4/22/2026, 8:31:42 AM
Last enriched: 4/22/2026, 8:48:26 AM
Last updated: 4/23/2026, 12:22:24 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.