CVE-2026-74012: TaxoPress Object Injection Vulnerability

CVE-2026-74012 Overview

CVE-2026-74012 is a PHP Object Injection vulnerability in the TaxoPress WordPress plugin (formerly Simple Tags). The flaw stems from deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 3.51.0. An authenticated attacker with low privileges can supply crafted serialized input that the plugin processes via unserialize(), triggering instantiation of arbitrary PHP objects. When combined with a suitable gadget chain in the application or other installed plugins, this can lead to remote code execution, arbitrary file operations, or complete site compromise.

Critical Impact
Authenticated attackers can inject arbitrary PHP objects into the TaxoPress plugin, potentially achieving code execution and full compromise of the WordPress site.

Affected Products

TaxoPress plugin for WordPress (also known as Simple Tags)
All versions from n/a through 3.51.0
WordPress sites with TaxoPress installed and enabled

Discovery Timeline

2026-08-18 - CVE-2026-74012 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74012

Vulnerability Analysis

The vulnerability is an insecure deserialization issue classified under [CWE-502]. TaxoPress accepts serialized PHP data from a request context and passes it to unserialize() without validating the input source or restricting allowed classes. During deserialization, PHP invokes magic methods such as __wakeup() and __destruct() on reconstructed objects, enabling gadget-chain execution when suitable classes exist in memory.

The attack requires authentication but only low privileges, meaning any account with contributor or subscriber-level access on affected sites may be sufficient. Successful exploitation impacts confidentiality, integrity, and availability. The attack is network-reachable through the standard WordPress HTTP interface.

See the Patchstack WordPress Vulnerability Advisory for additional technical details.

Root Cause

The root cause is direct use of PHP's unserialize() function on attacker-controlled input. The plugin does not sanitize, sign, or type-restrict serialized payloads. PHP's native serialization format allows arbitrary object instantiation, and any class with exploitable magic methods loaded in the WordPress runtime becomes a potential gadget for further exploitation.

Attack Vector

An authenticated attacker submits a crafted serialized payload to a vulnerable TaxoPress endpoint. The plugin deserializes the input, creating attacker-controlled objects. If a gadget chain exists in WordPress core, TaxoPress, or another installed plugin, the resulting method invocations can be chained to read files, write files, execute commands, or corrupt database state. Exploitation does not require user interaction.

No verified public proof-of-concept code is available at the time of publication. See the linked Patchstack advisory for exploitation context.

Detection Methods for CVE-2026-74012

Indicators of Compromise

HTTP requests to TaxoPress endpoints containing serialized PHP payloads beginning with markers such as O:, a:, or s: followed by class and property definitions
Unexpected PHP errors referencing __wakeup, __destruct, or unserialize() in web server logs
New or modified PHP files in the WordPress wp-content directory following requests to TaxoPress
Outbound network connections from the WordPress host originating from PHP-FPM or the web server process

Detection Strategies

Inspect web access logs for POST requests to TaxoPress AJAX or admin-ajax endpoints containing serialized object markers
Enable and review PHP error logs for warnings about unserialization of unknown classes or invalid property access
Monitor for creation of scheduled tasks, new administrator accounts, or modified plugin files after authenticated user activity

Monitoring Recommendations

Alert on WordPress file integrity changes, particularly within active plugin directories and wp-content/uploads
Track authentication events for low-privilege accounts that subsequently access administrative endpoints
Correlate WordPress audit logs with process and network telemetry from the underlying host to identify post-exploitation behavior

How to Mitigate CVE-2026-74012

Immediate Actions Required

Update TaxoPress to a version later than 3.51.0 once the vendor publishes a fixed release
Audit WordPress user accounts and remove or downgrade unnecessary low-privilege accounts that could be leveraged for authenticated exploitation
Review installed plugins and themes for known deserialization gadgets and remove any that are unused
Rotate WordPress secrets in wp-config.php and administrator passwords if compromise is suspected

Patch Information

At the time of publication, the advisory identifies TaxoPress versions through 3.51.0 as vulnerable. Site administrators should monitor the Patchstack advisory and the official plugin repository for the fixed release and apply it immediately upon availability.

Workarounds

Deactivate the TaxoPress plugin until a patched version is released and verified
Restrict access to the WordPress administrative interface and AJAX endpoints using IP allowlists or a web application firewall
Deploy WAF rules that block requests containing serialized PHP object markers targeting TaxoPress endpoints
Disable or tightly restrict account self-registration to reduce the pool of authenticated attackers

bash

# Configuration example: temporarily deactivate the plugin via WP-CLI
wp plugin deactivate simple-tags