CVE-2025-11972

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11972", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T15:36:04.101Z", "datePublished": "2025-11-08T03:27:48.135Z", "dateUpdated": "2026-04-08T17:03:03.733Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:03.733Z"}, "affected": [{"vendor": "stevejburge", "product": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.40.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e36f3a0-2215-4c1c-99c4-9405ad7b913b?source=cve"}, {"url": "https://github.com/TaxoPress/TaxoPress/commit/fd35042973439719b4304b336663e46f13f1533a"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Naoya Takahashi"}], "timeline": [{"time": "2025-10-22T17:44:55.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T14:07:30.594300Z", "id": "CVE-2025-11972", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T14:14:59.105Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-28T02:35:54.605Z"}, "references": [{"url": "https://wordpress.org/plugins/simple-tags/#developers"}, {"url": "https://github.com/TaxoPress/TaxoPress/pull/2828"}, {"url": "https://github.com/TaxoPress/TaxoPress/issues/2827"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wordpress.org/plugins/simple-tags/#developers"}, {"url": "https://github.com/TaxoPress/TaxoPress/pull/2828"}, {"url": "https://github.com/TaxoPress/TaxoPress/issues/2827"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-28T02:35:54.605Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11972", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T14:07:30.594300Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T14:07:31.232Z"}}], "cna": {"title": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Naoya Takahashi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "stevejburge", "product": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.40.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-22T17:44:55.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e36f3a0-2215-4c1c-99c4-9405ad7b913b?source=cve"}, {"url": "https://github.com/TaxoPress/TaxoPress/commit/fd35042973439719b4304b336663e46f13f1533a"}], "descriptions": [{"lang": "en", "value": "The Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-08T03:27:48.135Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11972", "state": "PUBLISHED", "dateUpdated": "2025-11-28T02:35:54.605Z", "dateReserved": "2025-10-20T15:36:04.101Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T03:27:48.135Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI", "vendor": "stevejburge", "versions": [{"lessThanOrEqual": "3.40.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El gestor de etiquetas, categor\u00edas y taxonom\u00edas - Autotagger de IA con plugin de OpenAI para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'post_types' en todas las versiones hasta la versi\u00f3n 3.40.0, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto permite a atacantes autenticados, con acceso de nivel Editor y superior, a\u00f1adir consultas SQL adicionales a consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-11972", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11972", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T14:07:30.594300Z", "version": "2.0.3"}}]}, "published": "2025-11-08T04:15:43.577", "references": [{"source": "security@wordfence.com", "url": "https://github.com/TaxoPress/TaxoPress/commit/fd35042973439719b4304b336663e46f13f1533a"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e36f3a0-2215-4c1c-99c4-9405ad7b913b?source=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/TaxoPress/TaxoPress/issues/2827"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/TaxoPress/TaxoPress/pull/2828"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://wordpress.org/plugins/simple-tags/#developers"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:01:26.747969+00:00", "value": {"mitigation_remediation": ["Upgrade the Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin to the latest version that fixes the SQL injection. ", "Restrict WordPress Editor access to trusted users only, or remove the Editor role from accounts that do not need tagging functions. ", "Deploy a web application firewall or SQL injection detection rule to monitor and block malicious post_types parameter values until the plugin is updated. ", "Optionally, review and sanitize the post_types input in the plugin code to prevent future injection attacks."], "summary": {"action": "Apply Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI developed by stevejburge. All releases up to and including 3.40.0 are impacted; newer versions may have resolved the issue. The only required condition is that the attacker has authenticated Editor-level access on the WordPress installation.", "description_and_impact": "The Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI plugin for WordPress contains a SQL injection vulnerability in the post_types parameter. In versions up to 3.40.0, the parameter is not properly escaped, allowing an authenticated user with Editor privileges or higher to inject additional SQL clauses. Successful exploitation could lead to unauthorized extraction of database content, compromising confidentiality of site data.", "risk_and_exploitability": "The CVSS score of 4.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, reinforcing that it has not been publicly exploited to date. An attacker would need legitimate access, making internal threat actors or compromised accounts the most likely vectors. Mitigation by updating the plugin is the recommended course of action."}}}}, "created": "2025-11-10T09:33:33.553941+00:00", "updated": "2026-04-22T12:15:16.041537+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}