Vulnerability · Published Aug 3, 2026 · Assigned by WPScan
CVE-2026-15231TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
Low 2.7
In plain English
A low-severity authorization bypass via user-controlled key in Tag, Category, and Taxonomy Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Tag, Category, and Taxonomy Manager | 0 – before 3.51.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/5980ab15-bc6e-4298-9d0c-92c17217ec2c/ exploit, vdb-entry, technical-description