The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → DeferredNVD modified 2026-10-16 14:51
- First seenCVSS 6.5NVD modified 2026-10-16 06:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve