CVE-2026-104743: Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmpfile' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The poisoned importer path is persisted to the database and later triggered via a separate GET request to the /sourceinfo endpoint, which passes the attacker-controlled path to fopen() and fgetcsv() and returns parsed file contents in the REST response.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with an Editor role or higher can exploit it. The attack is network-accessible and does not require user interaction.
What access does an attacker need to obtain file contents?
The attacker must be able to authenticate as an Editor or higher and submit a controlled value through the tmp_file parameter. They then trigger the persisted importer path through a separate GET request to the /source_info endpoint.
What is exposed if exploitation succeeds?
The attacker can read arbitrary files available to the server process. The endpoint parses the selected file with fopen() and fgetcsv() and returns parsed contents in the REST response, potentially exposing sensitive information.
Which versions are affected?
All Tainacan plugin versions up to and including 1.3.0 are affected.