CVE-2025-13359: TaxoPress WordPress Plugin SQL Injection

CVE-2025-13359 Overview

CVE-2025-13359 is a time-based SQL Injection vulnerability [CWE-89] in the TaxoPress WordPress plugin, marketed as Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI. The flaw affects all plugin versions up to and including 3.40.1. The getTermsForAjax function fails to properly escape user-supplied parameters and does not use prepared statements for its SQL queries. Authenticated attackers with Contributor-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive database contents, provided the account holds metabox access for the taxonomy, which is enabled by default for Contributors.

Critical Impact
Authenticated Contributor accounts can extract sensitive information from the WordPress database using time-based SQL injection payloads through the plugin's AJAX endpoint.

Affected Products

TaxoPress plugin for WordPress, all versions up to and including 3.40.1
WordPress installations exposing Contributor or higher role registration
Sites relying on default taxonomy metabox permissions for Contributors

Discovery Timeline

2025-12-03 - CVE-2025-13359 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13359

Vulnerability Analysis

The vulnerability resides in the static method getTermsForAjax located in inc/class.admin.php. This function accepts caller-controlled parameters including $taxonomy, $search, $order_by, $order, and $limit, and interpolates them into a SQL query executed through $wpdb without preparation or allowlisting. The $order_by parameter is particularly dangerous because a random value causes the code to substitute RAND() directly into the ORDER BY clause, and other values pass through unfiltered. An authenticated Contributor triggering the associated AJAX action supplies attacker-controlled SQL fragments that the database executes.

Because the endpoint returns limited output, exploitation is time-based: the attacker embeds conditional SLEEP() calls that reveal database content one bit at a time through response delay. The plugin's default configuration grants Contributors metabox access for taxonomies, making this endpoint reachable without additional privilege changes.

Root Cause

The root cause is insufficient input validation combined with unsanitized string interpolation into a SQL statement. The $order_by and $order parameters were not constrained to a fixed allowlist, and the $limit parameter was not cast to an integer. $wpdb->prepare() was not applied to the constructed query, leaving all injectable positions exposed to attacker input.

Attack Vector

The attacker authenticates to WordPress with a Contributor account and issues an AJAX request that invokes getTermsForAjax. By manipulating order_by, order, or limit in the request payload, the attacker injects SQL fragments containing conditional time-delay functions. The database's execution latency for each request discloses one boolean condition, allowing byte-by-byte reconstruction of secrets such as password hashes, session tokens, and administrative options.

php

// Security patch in inc/class.admin.php
public static function getTermsForAjax($taxonomy = 'post_tag', $search = '', $order_by = 'name', $order = 'ASC', $limit = 0)
{
    global $wpdb;

    $order = strtoupper($order);
    if (!in_array($order, ['ASC', 'DESC'], true)) {
        $order = 'ASC';
    }

    $allowed_orderby = [
        'name'   => 't.name',
        'count'  => 'tt.count',
        'random' => 'RAND()',
    ];

    if (isset($allowed_orderby[$order_by])) {
        $order_by_sql = $allowed_orderby[$order_by];
    } else {
        $order_by_sql = $allowed_orderby['name'];
    }

    $limit_sql = '';
    $limit = (int) $limit;
    if ($limit > 0) {
        // safe limit handling
    }
}

Source: TaxoPress commit 1097a221

The patch enforces an allowlist on $order_by, restricts $order to ASC or DESC, and casts $limit to an integer, removing the injection sinks.

Detection Methods for CVE-2025-13359

Indicators of Compromise

WordPress AJAX requests referencing TaxoPress taxonomy actions containing SQL keywords such as SLEEP(, BENCHMARK(, UNION, or IF( in order_by, order, or limit parameters
Elevated response times (multiple seconds) on TaxoPress AJAX endpoints from a single authenticated session
Repeated AJAX requests from Contributor accounts against admin-ajax.php targeting term-lookup actions

Detection Strategies

Inspect web server access logs for admin-ajax.php requests with unusual order_by or limit values submitted by non-administrator sessions
Enable MySQL slow query logging and alert on repeated queries against wp_terms and wp_term_taxonomy that include SLEEP or BENCHMARK
Use a Web Application Firewall (WAF) rule that blocks SQL metacharacters in TaxoPress AJAX parameters

Monitoring Recommendations

Correlate authenticated Contributor session activity with anomalous AJAX request volume or timing patterns
Monitor WordPress user role assignments to detect unexpected Contributor account creation
Track TaxoPress plugin version across managed sites and alert on installations at or below 3.40.1

How to Mitigate CVE-2025-13359

Immediate Actions Required

Update the TaxoPress plugin to the version containing commit 1097a221 or later on every WordPress site where it is installed
Audit existing Contributor, Author, and Editor accounts and remove any that are unnecessary or unrecognized
Review database logs for evidence of time-based injection since the plugin was installed and rotate credentials if compromise is suspected

Patch Information

The vendor fix is available in the TaxoPress GitHub commit 1097a221. The patch introduces allowlists for order_by and order, casts limit to an integer, and hardens the ordering logic in modules/taxopress-ai/classes/TaxoPressAiAjax.php. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Restrict Contributor role assignment and disable public registration until the plugin is patched
Remove taxonomy metabox permissions from Contributor accounts through a custom role management plugin
Deploy a WAF rule to block requests containing SQL time-delay functions against wp-admin/admin-ajax.php

bash

# Update TaxoPress via WP-CLI to the patched release
wp plugin update simple-tags --version=latest
wp plugin list --name=simple-tags --fields=name,status,version

# Optional: temporarily deactivate the plugin until update completes
wp plugin deactivate simple-tags