CVE-2025-14043
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. The create_item_permissions_check() function unconditionally returns true, bypassing authentication and authorization validation.
Risk Assessment
An unauthenticated attacker can create arbitrary metadata sections for any collection via the public REST API, potentially leading to data pollution or further attacks.
Recommendation
Update the Tainacan plugin to a version later than 1.0.1. Until then, consider restricting access to the public REST API or deploying WAF rules.
Other vulnerabilities in Tainacan
See all- CVE-2026-6230High
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping and lack of proper query preparation.
- CVE-2026-42740Critical
CVE-2026-42740 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Tainacan system. This issue affects Tainacan versions from n/a through 1.0.3.
- CVE-2026-93767Medium
The Tainacan plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 'guid' parameter. Authenticated attackers with subscriber-level access and above can read the contents of arbitrary files on the server, which can contain sensitive information.
- CVE-2026-90989Medium
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability. This allows any authenticated subscriber to read the email addresses of the repository's staff.
- CVE-2026-94676High
Tainacan through version 1.3.0 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.
- CVE-2026-95590High
The Tainacan plugin in versions up to and including 1.2.0 contains an SQL Injection vulnerability accessible to users with the Subscriber role. This allows injection of SQL code into database queries.
- CVE-2025-12747Medium
The Tainacan plugin for WordPress in all versions up to and including 1.0.0 is vulnerable to Information Exposure via uploaded files marked as private being exposed in wp-content without adequate protection. This allows unauthenticated attackers to extract potentially sensitive information from files marked as private.
- CVE-2025-12746Medium
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. This is due to the `create_item_permissions_check()` function unconditionally returning true, which bypasses authentication and authorization validation. This makes it possible for unauthenticated attackers to create arbitrary metadata sections for any collection via the public REST API granted they can access the WordPress site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS