CVE-2026-95590
HighCVSS 7.1Summary
The Tainacan plugin in versions up to and including 1.2.0 contains an SQL Injection vulnerability accessible to users with the Subscriber role. This allows injection of SQL code into database queries.
Risk Assessment
Even a low-privileged Subscriber account could exploit this flaw to manipulate database data, creating a risk of data leakage or loss.
Recommendation
Update the Tainacan plugin to a version newer than 1.2.0 or restrict subscriber registration until the fix is applied.
Other vulnerabilities in Tainacan
See all- CVE-2026-6230High
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping and lack of proper query preparation.
- CVE-2026-42740Critical
CVE-2026-42740 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Tainacan system. This issue affects Tainacan versions from n/a through 1.0.3.
Original NVD description (English source)
Subscriber SQL Injection in Tainacan <= 1.2.0 versions.