CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Read Description The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including,...

CVE-2024-7135

CVE-2024-7135 The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated...

CVE-2024-3867

CVE-2024-3867 This repository shows u some information on this vulnerability, which were found by me. Here is the official description given: The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate...

CVE-2026-104743

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmpfile' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-104743

The Tainacan plugin for WordPress (versions up to and including 1.3.0 ) is vulnerable to a Directory Traversal flaw via the tmp_file parameter through mass assignment . Authenticated attackers with editor-level access or higher can provide a poisoned importer path that is persisted to the databas...

EUVD-2026-111612

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmpfile' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-104743 Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmpfile' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-104743 Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmpfile' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,...

PT-2026-127856

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server,...

WordPress Tainacan plugin <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Editor+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Tainacan versions = 1.3.0...

CVE-2026-93767

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-93767

The Tainacan plugin for WordPress (versions up to and including 1.3.0 ) is vulnerable to a Directory Traversal vulnerability via the 'guid' parameter . This flaw allows authenticated attackers with Subscriber-level access or higher to perform an arbitrary file read , potentially exposing sensitiv...

EUVD-2026-102665

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-93767 Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-93767 Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-93767: Improper Limitation of a Pathname to a Restricted Directory

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

PT-2026-115463

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

WordPress Tainacan plugin <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Subscriber+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Tainacan versions = 1.3.0...

Tainacan path traversal vulnerability

Tainacan versions 1.3.0 and earlier have a path traversal vulnerability. This vulnerability stems from a directory traversal issue with the guid parameter. It can only be exploited if the uploads/tainacan directory does not exist. As a result, authenticated attackers at the subscriber level and...

CVE-2026-90989

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...