Is CVE-2026-4128 actively exploited?

No active exploitation of CVE-2026-4128 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4128 be exploited remotely?

Yes. CVE-2026-4128 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-4128?

CVE-2026-4128 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-4128

MEDIUM

CVE-2026-4128

CWE-862Published: April 22, 2026· Updated: Apr 22, 2026

4.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.6th

Official Description

The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.

NVD Source

Technical Analysis

CVE-2026-4128 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.