CVE-2026-93767: Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

Q: Which deployments are actually exposed to exploitation?

Only installations where the uploads/tainacan directory does not exist are exploitable under the described condition. When that directory is absent, realpath() returns false and the intended base-path containment check becomes ineffective.

Q: What level of access does an attacker need?

An attacker must be authenticated with at least Subscriber-level WordPress access. No user interaction is required, and the attack can be performed remotely.

Q: What can an attacker obtain through this issue?

An attacker can use path traversal through the guid parameter to read arbitrary files from the server. Those files may contain sensitive information; integrity and availability impacts are not described.

Q: What can be done while patching is unavailable?

Ensure that the uploads/tainacan directory exists on the server, because the vulnerability is described as exploitable only when that directory is missing. Also restrict or review Subscriber and higher-privileged accounts, since authentication is required.

Published Oct 16, 2026

Updated

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.

Affected Software

1 affected component

Tainacan Tainacan plugin for WordPress<=1.3.0

Event History

Oct 16, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are actually exposed to exploitation?

Only installations where the uploads/tainacan directory does not exist are exploitable under the described condition. When that directory is absent, realpath() returns false and the intended base-path containment check becomes ineffective.

What level of access does an attacker need?

An attacker must be authenticated with at least Subscriber-level WordPress access. No user interaction is required, and the attack can be performed remotely.

What can an attacker obtain through this issue?

An attacker can use path traversal through the guid parameter to read arbitrary files from the server. Those files may contain sensitive information; integrity and availability impacts are not described.

What can be done while patching is unavailable?

Ensure that the uploads/tainacan directory exists on the server, because the vulnerability is described as exploitable only when that directory is missing. Also restrict or review Subscriber and higher-privileged accounts, since authentication is required.

CVE-2026-93767: Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

Affected Software

Event History

Frequently Asked Questions

Which deployments are actually exposed to exploitation?

What level of access does an attacker need?

What can an attacker obtain through this issue?

What can be done while patching is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are actually exposed to exploitation?

What level of access does an attacker need?

What can an attacker obtain through this issue?

What can be done while patching is unavailable?