Live › vulnerability › CVE-2026-104743
Go to dashboardThe Tainacan plugin for WordPress up to and including 1.3.0 accepts a crafted 'tmp_file' parameter that is stored and later passed to fopen() and fgetcsv(), so the path is not restricted. An authenticated editor can read arbitrary files on the server, which may include sensitive configuration or credentials, and the contents are returned in the REST response.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
WordPress sites running the Tainacan plugin at version or earlier where users with editor-level access or above can reach the importer. Sites without Tainacan, or with the plugin on a later version, are not affected. Sites where only administrators can edit content have a smaller exposure but the sources do not say that this removes the risk.
1.3.0No product ranges from the sources yet.
1.3.0 and earlier are affected.1.3.0, if a fixed release is available; the sources do not name one.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The poisoned importer path is persisted to the database and later triggered via a separate GET request to the /source_info endpoint, which passes the attacker-controlled path to fopen() and fgetcsv() and returns parsed file contents in the REST response.
This page as .md · .json · in your agent: get_signal("CVE-2026-104743")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.