Tainacan CVE-2026-95590

Requires an authenticated WordPress Subscriber account (PR:L) on a site running the Tainacan plugin version 1.2.0 or earlier; the practical prerequisite is that the site allows user self-registration (or the attacker otherwise obtains low-privilege credentials), so sites with registration disabled are substantially harder to exploit. The attacker must reach the specific vulnerable plugin parameter over the network (AV:N). No user interaction is needed (UI:N). The vendor-assigned AC:H suggests some specialized crafting or preconditions beyond a trivial payload, which further limits opportunistic exploitation.

This is a genuine but bounded threat. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L, 7.1) indicates a network-reachable, authenticated (PR:L) SQL injection whose primary impact is confidentiality (C:H). Two of the vendor's metric choices are questionable: SQL injection is normally low-complexity to exploit once the injectable parameter is known, so AC:H may overstate difficulty, and injection confined to the plugin's own database queries typically does not cross a security boundary, so S:C (scope change) is aggressive versus a more defensible S:U. No EPSS score, no CISA KEV listing, and no public POC were provided, and no vendor fix version is stated. Exploitation status: no public exploit identified at time of analysis. The mitigating anchor is PR:L - an attacker needs a valid Subscriber account, the lowest WordPress role, which is trivially self-registrable only if the site enables open user registration. This is a real priority for exposed Tainacan sites with open registration but not an internet-wide mass-exploitation candidate; the absence of EPSS/KEV/POC suggests no confirmed widespread exploitation.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running Tainacan <= 1.2.0, then submits a crafted request to a vulnerable plugin endpoint whose input is concatenated into a SQL query. By injecting SQL, the attacker extracts sensitive database contents such as user records, password hashes, and secrets (C:H). No public POC is referenced, and the authenticated-Subscriber requirement plus the vendor's AC:H rating imply some non-trivial crafting is involved.