WordPress Plugin Vulnerabilities

TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

Description

The plugin does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.

Proof of Concept

Affects Plugins

Plugin icon
simple-tags
Fixed in 3.51.0

References

CVE
CVE-2026-15231

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Duy Tran
Submitter
Duy Tran
Submitter website
https://mrdarkroot.github.io/
Verified
Yes
WPVDB ID
5980ab15-bc6e-4298-9d0c-92c17217ec2c

Timeline

Publicly Published
2026-07-24 (about 11 days ago)
Added
2026-07-24 (about 10 days ago)
Last Updated
2026-07-29 (about 6 days ago)

Other

Published
Title
Published
2026-05-27
Title
Meta Field Block < 1.5.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure
Published
2026-04-15
Title
Payment Gateway for Redsys & WooCommerce Lite < 7.0.1 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
Published
2026-03-10
Title
ExactMetrics 8.6.0 - 9.0.2 - Insecure Direct Object Reference to Arbitrary Plugin Installation
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR
Published
2024-12-02
Title
Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure