CVE-2026-4128: tplugins tp restore categories and taxonomies Missing Authorization

Vulnerability summary

CVE-2026-4128 is a medium (CVSS 4.3) Missing Authorization vulnerability in tplugins tp restore categories and taxonomies. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.7% of scored vulnerabilities.

Timeline

1. 22-04-2026
   PublishedVulnerability first disclosed.
2. 22-04-2026
   Last modifiedVulnerability information updated.

Description

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.