Overview
The “Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI” (TaxoPress AI Autotagger) plugin, widely used for WordPress websites, has been found to have a notable security vulnerability. This flaw could allow unauthorized access to sensitive database information.
This particular vulnerability is a time-based SQL Injection, which means an attacker could cleverly craft input to force the database to delay its responses, thereby revealing information bit by bit. It affects all versions of the plugin up to and including 3.40.1.
An attacker would need to be authenticated with at least ‘contributor’ level access. If they have this access and can interact with the taxonomy metabox (which is usually enabled for contributors by default), they could exploit this flaw. By injecting malicious SQL queries into existing database commands, they could extract confidential data. The root cause lies in how the plugin handles user-provided data, specifically failing to properly clean or “escape” these inputs and not adequately preparing database queries. This creates an opening for attackers to manipulate the database operations.
From the code changes in the official GitHub repository, it’s clear that the developers addressed this by implementing stricter validation and sanitization for the order_by, order, and limit parameters in the getTermsForAjax function. This prevents malicious input from altering the SQL queries.
CVE Details
- Product Name: Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress
- CVE ID: CVE-2025-13359
- Published Date: December 3, 2025
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts the following product:
- TaxoPress: All versions up to, and including, 3.40.1
If you are running any version of the “Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI” plugin equal to or older than 3.40.1, your WordPress site could be at risk.
Current Status
This vulnerability has been thoroughly analyzed.
Severity Level
The severity of CVE-2025-13359 is rated as Medium with a CVSS score of 6.5. This indicates that while exploitation requires authenticated access, a successful attack could lead to significant data exposure.
Possible Solutions
The most critical step is to update your “Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI” plugin immediately. The developers have released a patch addressing the insufficient escaping and SQL query preparation issues.
- Update: Ensure your plugin is updated to a version greater than 3.40.1. Always back up your WordPress site before performing any plugin updates.
- Least Privilege: As a general security best practice, ensure that user accounts only have the minimum necessary permissions. While this vulnerability requires contributor-level access, limiting unnecessary privileges can reduce the overall attack surface for other potential issues.
- Monitor: Regularly monitor your WordPress site for any unusual activity.
References
https://github.com/TaxoPress/TaxoPress/commit/1097a22181aa10ce55cc9cd5fa8495f7494e18ea
https://www.wordfence.com/threat-intel/vulnerabilities/id/d9bebdc0-1625-4dc4-8c92-37f379868cd5?source=cve
