CVE-2025-14371: 
WordPress vulnerability analysis and mitigation

CVE-2025-14371 is a missing authorization vulnerability in the TaxoPress: Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress. It affects all versions up to and including 3.41.0, allowing authenticated attackers with Contributor-level access or above to add or remove taxonomy terms (tags, categories) on any post, including posts they do not own. The vulnerability was disclosed on January 6, 2026, with a patch available in version 3.41.1. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence (Wordfence, Feedly).

The root cause is a missing capability check (CWE-862) on the taxopress_ai_add_post_term function within the plugin's AJAX handler class (TaxoPressAiAjax.php). Because no authorization check verifies whether the requesting user has permission to modify a given post's taxonomy terms, any authenticated user with at least Contributor-level access can invoke this function via a network request. The vulnerable code is visible in the plugin's source at line 681 of TaxoPressAiAjax.php in version 3.40.1 (WordPress Trac). A technical write-up is also available from CleanTalk Research (CleanTalk).

Successful exploitation allows an authenticated attacker to arbitrarily add or remove tags and categories on any WordPress post, regardless of post ownership. This compromises content integrity across the site — for example, an attacker could strip important categories from posts, inject misleading tags, or disrupt SEO-critical taxonomy structures. There is no confidentiality or availability impact; the vulnerability is limited to unauthorized data modification (Wordfence, Feedly).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid Contributor-level WordPress account on the target site, limiting the attack surface (Feedly, Wordfence).

1. Reconnaissance: Identify a WordPress site running the TaxoPress AI Autotagger plugin at version 3.41.0 or earlier, and obtain or register a Contributor-level (or higher) account on the target site.
2. Identify the vulnerable AJAX endpoint: Locate the WordPress AJAX action associated with the taxopress_ai_add_post_term function, which is exposed without a capability check.
3. Craft a malicious request: As an authenticated Contributor, send a crafted HTTP POST request to the WordPress AJAX handler (e.g., wp-admin/admin-ajax.php) with the appropriate action parameter and a target post ID belonging to another user.
4. Modify taxonomy terms: Include the desired taxonomy term (tag or category) in the request payload to add or remove it from the target post, bypassing any ownership or permission validation.
5. Achieve objective: Confirm that the taxonomy terms on the victim post have been altered, achieving unauthorized content modification (WordPress Trac, CleanTalk).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php with the TaxoPress AI action parameter from Contributor-level user accounts, especially targeting post IDs not owned by those users.
• Application Logs: Unexpected taxonomy term changes (tag/category additions or removals) on posts not authored by the modifying user, visible in WordPress post revision or audit logs if audit logging is enabled.
• Behavioral: Multiple posts across the site experiencing unexplained taxonomy changes within a short time window, particularly if correlated with a single low-privileged user account.

Users should update the TaxoPress plugin to version 3.41.1 or later, which introduces the missing capability check and resolves the vulnerability. No configuration-based workaround is available short of disabling the plugin entirely. Site administrators should also audit recent taxonomy changes on posts to identify any unauthorized modifications made prior to patching (Wordfence, Feedly).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry covering the issue. Sucuri included CVE-2025-14371 in its January 2026 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). Community coverage has been limited given the medium severity and low exploitation probability.