CVE-2026-93767
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The Tainacan plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 'guid' parameter. Authenticated attackers with subscriber-level access and above can read the contents of arbitrary files on the server, which can contain sensitive information.
Risk Assessment
The ability to read arbitrary files on the server may lead to leakage of configuration data, credentials, or other sensitive information. The vulnerability is exploitable only when the uploads/tainacan directory does not exist.
Recommendation
Update the plugin to a version later than 1.3.0 and ensure the uploads/tainacan directory exists on the server to mitigate the vulnerability.
Other vulnerabilities in Tainacan
See all- CVE-2026-6230High
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping and lack of proper query preparation.
- CVE-2026-42740Critical
CVE-2026-42740 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Tainacan system. This issue affects Tainacan versions from n/a through 1.0.3.
- CVE-2026-90989Medium
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability. This allows any authenticated subscriber to read the email addresses of the repository's staff.
- CVE-2026-94676High
Tainacan through version 1.3.0 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.
- CVE-2026-95590High
The Tainacan plugin in versions up to and including 1.2.0 contains an SQL Injection vulnerability accessible to users with the Subscriber role. This allows injection of SQL code into database queries.
Original NVD description (English source)
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS