CVE-2025-14371

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.

An attacker registers or compromises a Contributor account on a target WordPress site running the vulnerable plugin. With no AI expertise required, they craft a direct POST to the taxopress_ai_add_post_term AJAX endpoint, targeting arbitrary post IDs to inject misleading tags or strip accurate categories from high-traffic or compliance-sensitive content. If the site uses a RAG pipeline that ingests WordPress taxonomy for content retrieval or classification, the attacker's poisoned taxonomy silently degrades retrieval relevance over weeks—going undetected until a content audit or user complaint surfaces the manipulation. The attack leaves no obvious footprint in standard WordPress logs unless activity monitoring is enabled.