CVE-2026-15231: TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15231?
The severity of CVE-2026-15231 is rated at risk 40.
What does CVE-2026-15231 exploit?
CVE-2026-15231 exploits a failure to verify user authorization, allowing contributors to access private or draft posts.
How do I fix CVE-2026-15231?
To fix CVE-2026-15231, update the TaxoPress WordPress plugin to version 3.51.0 or later.
Who is affected by CVE-2026-15231?
Users with contributor privileges on sites using TaxoPress versions prior to 3.51.0 are affected by CVE-2026-15231.
What data is vulnerable due to CVE-2026-15231?
CVE-2026-15231 allows unauthorized access to data from private or draft posts that contributors do not own.