Tainacan CVE-2026-104743

Requires an authenticated account with editor-level privileges or above (PR:H) on a site running the Tainacan plugin ≤1.3.0, and use of the plugin's importer feature: the attacker must first create/update an importer session via the REST importers controller (update_item) to persist an attacker-controlled 'tmp_file' path containing directory-traversal sequences, then issue a separate GET request to the /source_info endpoint which passes that path to fopen() and fgetcsv(). Limiting factors: the editor-level authentication requirement sharply narrows who can exploit this (not anonymous/public); exploitation depends on the vulnerable importer/CSV code path present in versions up to and including 1.3.0, fixed in 1.4.0 where paths are constrained via resolve_allowed_tmp_file() to existing files inside the WordPress uploads directory.

This is a moderate-severity information-disclosure issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) shows network-reachable, low-complexity exploitation but requires high privileges - the description confirms editor-level access and above, consistent with PR:H. Impact is confined to confidentiality (arbitrary file read); there is no integrity or availability effect. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a privileged-only file-read. No EPSS score is provided in the input, the CVE is not listed in CISA KEV, and no working exploit code is referenced - the available links are the Wordfence advisory, WordPress trac source lines, and the fixing GitHub commit, i.e. patch/source evidence rather than an exploit. The practical risk is therefore an authenticated insider or a compromised editor account reading sensitive server files (e.g. wp-config.php); the PR:H requirement meaningfully limits mass exploitation. Signals are internally consistent - no conflict between the CVSS vector and the description, both indicating authenticated (editor+) remote access with confidentiality-only impact.

An attacker who has obtained editor-level (or higher) access to a WordPress site running Tainacan ≤1.3.0 sends a REST request that stores a traversal path (e.g. ../../../../wp-config.php) in the 'tmp_file' parameter of an importer session, persisting it to the database. A subsequent GET request to the /source_info endpoint passes that attacker-controlled path to fopen()/fgetcsv() and returns the parsed file contents in the REST response, disclosing arbitrary server files. No working exploit code is referenced in the available sources; the low attack complexity (AC:L) means the request itself is simple once editor access is held.