TP Restore Categories And Taxonomies: A security weakness
TP Restore Categories And Taxonomies is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.0.1.
- Component
- TP Restore Categories And Taxonomies
- Plugin slug
tp-restore-categories-and-taxonomies- Affected
- <= 1.0.1
- Safe version
> 1.0.1- Published
- Apr 22, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Apr 22, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update TP Restore Categories And Taxonomies to a release after 1.0.1, or disable and remove it until a fixed version is available.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N