CVE-2026-15231
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Tag, Category, and Taxonomy Manager WordPress plugin before version 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data. This allows users with contributor privileges to disclose data from private or draft posts they do not own.
Risk Assessment
The organization risks exposure of content from private or unpublished posts, which can compromise confidentiality and content integrity.
Recommendation
Update the Tag, Category, and Taxonomy Manager plugin to version 3.51.0 or later, which verifies post access permissions.
Original NVD description (English source)
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.