CVE-2026-15231CWE-639

CVE-2026-15231

Low · published August 3, 2026

CVSS v3.1

2.7

EPSS

Percentile

21.4

In the wild

Unconfirmed

What it is

The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.

The record

Technical detail

CVSS v3.1: 2.7 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00299 · 21.4th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-03T11:16Z

References (1)

https://wpscan.com/vulnerability/5980ab15-bc6e-4298-9d0c-92c17217ec2c/ · [email protected]

EPSS history

Timeline

03 AUG 06:00Z
TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
cvelistv5