Tainacan CVE-2026-94676

Exploitation requires an authenticated session with high privileges (CVSS PR:H - effectively a WordPress administrator or equivalent role that can reach the plugin input which is deserialized), against a site running the Tainacan plugin version 1.3.0 or earlier. The core precondition is that attacker-controlled data reaches the plugin's unserialize() path; successful object injection additionally depends on a usable POP/gadget chain being present in the loaded codebase (plugin, WordPress core, or other active plugins). Primary limiting factors: the high-privilege authentication requirement sharply narrows the attacker population, and the plugin's niche deployment (digital repository/collection management) limits the attack surface; no user interaction is required (UI:N) and the vector is network-based (AV:N).

This is a CWE-502 PHP Object Injection flaw in the Tainacan WordPress plugin (affected through 1.3.0), with a vendor/NVD-sourced CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent but point to a moderate, not emergency, real-world priority. The vector is network-reachable with low attack complexity and no user interaction, and the triple-High impact (C/I/A) reflects the typical RCE/full-compromise potential of object injection - however, PR:H means the attacker must already hold high privileges (effectively an administrator or equivalent authenticated role), which is the dominant risk-limiting factor. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination (high impact but high-privilege precondition, no exploitation signals) places this as a worthwhile patch target rather than a drop-everything issue. Note a gap: the input provides no EPSS/KEV/POC data at all - their absence is not evidence of low risk, only of missing enrichment, so monitoring is advised.

An attacker who already holds a high-privilege (administrator-level) account on a WordPress site running Tainacan ≤1.3.0 submits a crafted serialized PHP payload to an input that the plugin deserializes without validation. The unserialize operation instantiates attacker-controlled objects, triggering a gadget chain that can lead to arbitrary file operations, SQL injection, or remote code execution in the site context. No public exploit code is identified at time of analysis, and the attack requires no victim user interaction.