Live › vulnerability › CVE-2026-93767
Go to dashboardThe Tainacan plugin for WordPress up to and including 1.3.0 fails to contain paths built from the 'guid' parameter. An authenticated subscriber can read arbitrary files on the server, which may hold sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Tainacan plugin at version 1.3.0 or earlier where subscriber-level accounts exist. The sources say exploitation only works when the directory does not exist, so sites that have it may be less exposed, but this is not confirmed. Sites without Tainacan, or with no user registration, can skip it.
uploads/tainacanNo product ranges from the sources yet.
wp plugin get tainacan --field=versionuploads/tainacan directory is missing under wp-content/uploads, since the sources say this is required for exploitation1.3.0 (the sources do not name the fixed version: unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.
This page as .md · .json · in your agent: get_signal("CVE-2026-93767")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.