Auth bypass in Stevejburge Tag, Category, And Taxonomy Manager – Ai Autotagger With Openai

CVE-2025-13354

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.

Vulnerability class: Broken Access Control

EPSS: 0.002 (15.7th percentile) — read the EPSS interpretation.