tplugins TP Restore Categories and Taxonomies Plugin up to 1.0.1 on WordPress AJAX profile.php delete_term authorization

Summaryinfo

A vulnerability described as problematic has been identified in tplugins TP Restore Categories and Taxonomies Plugin up to 1.0.1 on WordPress. The affected element is the function delete_term of the file profile.php of the component AJAX Handler. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2026-4128. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in tplugins TP Restore Categories and Taxonomies Plugin up to 1.0.1 on WordPress. This vulnerability affects the function delete_term of the file profile.php of the component AJAX Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity, and availability. CVE summarizes:

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.

The weakness was shared by Nabil Irawan. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-4128 since 03/13/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:profile.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• tplugins

Name

• TP Restore Categories and Taxonomies Plugin

Version

• 1.0.0
• 1.0.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion