MediumVulnerability
CVE-2025-13922: Tag, Category, and Taxonomy Manager AI Autotagger WordPress plugin SQL injection
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-13922
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
A time-based blind SQL injection flaw exists in the Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress, in all versions up to and including 3.40.1. The flaw sits in the 'existing_terms_orderby' parameter of the AI preview AJAX endpoint, caused by insufficient escaping and missing query parameterization. An authenticated attacker with Contributor-level access or above, holding AI metabox permissions, can append SQL queries to existing ones to extract sensitive database information, degrade performance, or infer data via time-based techniques.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
- HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database
- MediumCVE-2026-113459: TYPO3 OpenAI API key exposed to backend users in page sourceSame vendor · NVD/CVE Database
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database