Path traversal in Tainacan WordPress plugin exposes server files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The Tainacan plugin for WordPress is affected in all versions up to and including 1.3.0. A directory traversal flaw (CWE-22) in the 'guid' parameter lets authenticated attackers with subscriber-level access or higher read arbitrary files on the server, which can contain sensitive information. It is exploitable only when the uploads/tainacan directory does not exist on the server.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Tainacan.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-93767
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-16 Alias added: GHSA-9q7f-9qf7-62pg
- 2026-10-16 CISA SSVC decision points changed
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan
More tainacan vulnerabilities
- TI-2024-20253 WordPress Tainacan plugin <= 0.20.7 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-30963 WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2025-30009 WordPress Tainacan plugin <= 0.21.14 - Arbitrary File Deletion vulnerability CVSS 3.1HIGH 8.6
- TI-2026-05467 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter CVSS 3.1HIGH 7.5
- TI-2024-32242 WordPress Tainacan plugin <= 0.21.8 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
- TI-2024-06604 Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-93767 · CVE Program
- CVE-2026-93767 · NVD
- FIRST EPSS
- GHSA-9q7f-9qf7-62pg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences