CVE-2026-15231 — TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning …
Published: 2026-08-03 · CVSS: 2.7 · CVSS 3.1
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7