CVE-2026-95590: WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Tainacan pluginto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue is described as a subscriber SQL injection, so exploitation requires subscriber-level access to a site running an affected Tainacan version.
Can this be exploited remotely without user interaction?
The vector is network-based and no user interaction is required. However, the attack complexity is rated high, indicating exploitation is not expected to be straightforward even with the required access.
What is the likely impact if exploitation succeeds?
The severity vector indicates high confidentiality impact and low availability impact, with no integrity impact. The scope is changed, meaning the impact may extend beyond the vulnerable component's security authority.