Tainacan CVE-2026-90989

Exploitation requires an authenticated WordPress account at subscriber level or higher (PR:L) on a site running the Tainacan plugin before version 1.4.0; the specific prerequisite is access to the plugin's reports REST endpoints, which lack a management-capability authorization check. The limiting factors are: (1) the attacker must already hold or be able to self-register a subscriber account - so sites that disable open registration significantly reduce exposure; and (2) the disclosed data is limited to repository staff email addresses, providing reconnaissance/phishing value rather than direct system compromise. No special non-default configuration is required beyond having the vulnerable plugin version installed and active.

This is a genuine but low-severity information-disclosure flaw, not a high-priority emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable and low-complexity, but requiring authentication (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The EPSS score of 0.17% (6th percentile) indicates very low probability of exploitation in the wild, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. Publicly available exploit code exists (via WPScan), which modestly raises opportunistic risk, but POC availability is distinct from active exploitation and the signals are consistent rather than conflicting: a low-impact, auth-gated info leak with low EPSS and no KEV listing. The practical risk is bounded - an attacker must first obtain a valid subscriber account on the target site, and the payoff is only staff email addresses (useful for phishing/reconnaissance, not direct compromise). Overall: a real issue worth patching on a normal cadence, but not a drop-everything priority.

An attacker registers or acquires a low-privileged subscriber account on a WordPress site running Tainacan prior to 1.4.0, then sends an authenticated request to the plugin's reports REST endpoint, which fails to enforce a management capability check. The response discloses the email addresses of the repository's staff, which the attacker harvests for targeted phishing or social-engineering. A public proof-of-concept exists via WPScan; the low attack complexity (AC:L) means no special timing or conditions are needed once a subscriber token is held.