PT-2026-67062

CVE-2026-15231

Published

2026-07-24

Updated

2026-08-04

Description by

CVSS 3.1

2.7

Low

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tag, Category, and Taxonomy Manager versions prior to 3.51.0

Description This issue occurs because the plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived data. Consequently, users with contributor privileges can disclose information from private or draft posts that they do not own.

Recommendations Update to version 3.51.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Duy Tran

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers