What is the CVSS score of CVE-2026-6230?

CVE-2026-6230 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Tainacan are affected by CVE-2026-6230?

Tainacan WordPress plugin (versions 1.0.3 and earlier) permits unauthenticated remote attackers to extract all database contents without authentication or user interaction.

How to fix or mitigate CVE-2026-6230?

Within 24 hours: disable Tainacan plugin or confirm installed version exceeds 1.0.3; search web server access logs for 'geoquery' parameter requests; inventory all WordPress instances using this plugin. Within 7 days: conduct database forensic audit to detect unauthorized data access; deploy WAF rules to block SQL injection patterns in geoquery parameter. Within 30 days: implement continuous vendor patch monitoring for Tainacan updates; establish quarterly plugin security review process; evaluate alternative plugins if no patch is released.

Tainacan CVE-2026-6230

EUVD-2026-42215 HIGH

SQL Injection (CWE-89)

2026-07-08 Wordfence

GHSA-cqgm-j57m-cj34

WordPress SQLi Tainacan

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network request reaches the vulnerable parameter (AV:N/AC:L/PR:N/UI:N); blind SQLi enables data read (C:H) but no writes or downtime (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:38 vuln.today

CVE Published

Jul 08, 2026 - 11:30 nvd

HIGH 7.5

DescriptionCVE.org

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Tainacan WordPress plugin (versions ≤ 1.0.3) lets unauthenticated attackers exfiltrate database contents through the 'geoquery' parameter, which is concatenated into a SQL query without proper escaping or prepared-statement binding. Because the injection is time-based blind, attackers infer data character-by-character from response delays rather than direct output. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the network-reachable, no-authentication vector makes it a realistic target for automated scanning once details spread.

Technical ContextAI

Tainacan is an open-source WordPress plugin used to build and manage digital repositories, collections, and museum/archive catalogs, exposing search and filtering endpoints to site visitors. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the plugin takes the user-supplied 'geoquery' geospatial filter parameter and interpolates it into an existing SQL statement instead of using WordPress's $wpdb->prepare() placeholders, allowing attacker-controlled SQL to be appended to the legitimate query. The affected component is identified by CPE cpe:2.3:a:tainacan:tainacan (all versions through 1.0.3). Time-based blind injection is the exploitable form here, meaning the query result is not reflected to the attacker, so data is recovered by injecting conditional SLEEP/BENCHMARK-style delays and observing WordPress response latency.

RemediationAI

Upstream fix available (commit 579d28d7752b27ed3407f5197abb6349b3efc3c9); a released patched version is not independently confirmed from the provided data, so upgrade to the first Tainacan release published after commit 579d28d (verify the version tag against the Tainacan GitHub repository and the Wordfence advisory before deploying). Until a tagged release is confirmed and applied, restrict or block access to the plugin's search/filter endpoints that accept the 'geoquery' parameter - for example, add a WAF or ModSecurity rule to reject requests containing 'geoquery' with SQL metacharacters or SLEEP/BENCHMARK payloads, which may break legitimate geospatial filtering for site visitors, or disable the geospatial query feature/collection if unused. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/241d9cd3-9331-49b2-8083-dc646070488e?source=cve) for detection signatures, and rotate WordPress secrets and database credentials if you suspect the endpoint was exposed and probed.