CVE-2026-90989: Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/tainacanto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can access the affected reports REST endpoints. The issue exposes email addresses of repository staff.
Are anonymous visitors able to retrieve the staff email addresses?
No. The described issue requires an authenticated WordPress account; unauthenticated access is not indicated.
Which deployments are affected?
Tainacan versions before 1.4.0 are affected. The vulnerable condition is insufficient capability checking on the plugin's reports REST endpoints.
What is the remediation?
Update Tainacan to version 1.4.0 or later. The available information does not identify an alternative mitigation if updating cannot be done immediately.