The “Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI” (TaxoPress AI Autotagger) plugin, widely used for WordPress websites, has been found to have a notable security vulnerability. This flaw could allow unauthorized access to sensitive database information.<\/p>\n
This particular vulnerability is a time-based SQL Injection, which means an attacker could cleverly craft input to force the database to delay its responses, thereby revealing information bit by bit. It affects all versions of the plugin up to and including 3.40.1.<\/p>\n
An attacker would need to be authenticated with at least ‘contributor’ level access. If they have this access and can interact with the taxonomy metabox (which is usually enabled for contributors by default), they could exploit this flaw. By injecting malicious SQL queries into existing database commands, they could extract confidential data. The root cause lies in how the plugin handles user-provided data, specifically failing to properly clean or “escape” these inputs and not adequately preparing database queries. This creates an opening for attackers to manipulate the database operations.<\/p>\n
From the code changes in the official GitHub repository, it’s clear that the developers addressed this by implementing stricter validation and sanitization for the The vulnerability impacts the following product:<\/p>\n If you are running any version of the “Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI” plugin equal to or older than 3.40.1, your WordPress site could be at risk.<\/p>\n This vulnerability has been thoroughly analyzed.<\/p>\n The severity of CVE-2025-13359 is rated as Medium<\/strong> with a CVSS score of 6.5. This indicates that while exploitation requires authenticated access, a successful attack could lead to significant data exposure.<\/p>\n The most critical step is to update your “Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI” plugin immediately. The developers have released a patch addressing the insufficient escaping and SQL query preparation issues.<\/p>\n https:\/\/github.com\/publishpress\/publishpress-taxonomies\/commit\/1097a22181aa10ce55cc9cd5fa8495f7494e18ea Overview The “Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI” (TaxoPress AI Autotagger) plugin, widely used for WordPress websites, has been found to have a notable<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[715,763,751,695,719],"class_list":["post-2637","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-plugin-vulnerability","tag-sql-injection","tag-taxopress","tag-web-security","tag-wordpress-security"],"yoast_head":"\norder_by<\/code>, order<\/code>, and limit<\/code> parameters in the getTermsForAjax<\/code> function. This prevents malicious input from altering the SQL queries.<\/p>\nCVE Details<\/h2>\n
\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n
\nhttps:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/d9bebdc0-1625-4dc4-8c92-37f379868cd5?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":"