🔐 CVE Alert

CVE-2026-93767

MEDIUM 6.5

Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.

CWE CWE-22
Vendor tainacan
Product tainacan
Published Oct 16, 2026
Stay Ahead of the Next One

Get instant alerts for tainacan tainacan

Be the first to know when new medium vulnerabilities affecting tainacan tainacan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

tainacan / Tainacan
0 ≤ 1.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan

Credits

Wordfence PRISM