Tainacan EUVD-2026-102665

Two concrete prerequisites must both hold. First, the attacker needs an authenticated WordPress account at subscriber level or above (PR:L), so fully anonymous exploitation is not possible; sites allowing open user registration effectively lower this barrier. Second, and decisively, the server's uploads/tainacan directory must NOT exist - the description states this is the only condition under which the bug is exploitable, because a missing directory makes realpath() return false, collapses the base path to an empty string, and defeats the path-containment check. On any installation where Tainacan has already run and created uploads/tainacan, the containment check holds and exploitation fails. Exploitation targets the REST background-processes controller's 'guid' parameter and yields read-only disclosure of arbitrary files (e.g., wp-config.php); it does not provide write or code execution.

This is a moderate, conditional file-read vulnerability rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N, base 6.5) indicates network-reachable exploitation requiring only subscriber-level authentication, with high confidentiality impact but no integrity or availability impact - consistent with arbitrary file read via the REST background-processes controller. No EPSS score, KEV listing, SSVC decision, or POC was supplied in the input, so there is no evidence of active exploitation or public exploit code; per precision rules this is treated as no public exploit identified at time of analysis. The single most important mitigating signal is in the description itself and conflicts with the AC:L rating: exploitation only succeeds when the uploads/tainacan directory does not exist, because realpath() then returns false and collapses the containment base path. That precondition is an environmental attack requirement outside the attacker's control and materially narrows real-world exploitability, so the vendor's AC:L is arguably optimistic (AC:H / AT:P is more defensible). Net: a genuine authenticated information-disclosure bug worth patching, but not a widescale drive-by threat - priority is tempered by the non-default directory precondition and the subscriber-or-above authentication requirement.

An attacker who holds or registers a subscriber-level account on a WordPress site running Tainacan ≤1.3.0 sends a crafted REST request to the background-processes controller supplying a traversal payload in the 'guid' parameter. On a server where the uploads/tainacan directory has not yet been created, the broken containment check lets the request read arbitrary files such as wp-config.php, exposing database credentials and secret keys. No public exploit code was provided in the input, so this is a plausible but not demonstrated attack.