CVE-2026-15231 TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
Contributors can access private or draft post data from other users due to missing authorization checks in the TaxoPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15231?
CVE-2026-15231 is a low-severity missing authorization vulnerability in Unknown Tag, Category, and Taxonomy Manager, published on 3 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
Weakness: CWE-639
Which versions are affected by CVE-2026-15231?
How do I fix CVE-2026-15231?
No fix has been published for CVE-2026-15231 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-15231 being exploited?
There is no known exploitation of CVE-2026-15231 in the wild and no public exploit code.
Sources
Also known as GHSA-2fw4-4h2j-gcmv.