CVE-2026-15231

TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.

Affected

Tag, Category, and Taxonomy Manager

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2026-08-03

Updated

2026-08-04

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5980ab15-bc6e-4298-9d0c-92c17217ec2c/

References

• CVE Record
• NVD entry