Unauthorized Data Modification in Taxonomy Manager Plugin by OpenAI for WordPress
CVE-2025-14371

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Taxopress: Tag, Category, And Taxonomy Manager – Ai Autotagger
Vendor
CVE Published:
6 January 2026

What is CVE-2025-14371?

The AI Autotagger plugin for WordPress faces a significant security flaw due to a missing capability check in the taxopress_ai_add_post_term function. This oversight allows authenticated users with Contributor-level access and higher to manipulate taxonomy terms—such as adding or removing tags and categories—on any post, irrespective of ownership. As a result, this vulnerability poses a risk to data integrity and could facilitate undesirable content management actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

TaxoPress: Tag, Category, and Taxonomy Manager – AI Autotagger * <= 3.41.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-tags/ta...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
JSON
.