{"id":"CVE-2026-93767","kind":"vulnerability","aliases":["CVE-2026-93767"],"related":[],"title":"Tainacan WordPress plugin: directory traversal lets subscribers read server files","description":"The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.","summary":"The Tainacan plugin for WordPress up to and including 1.3.0 fails to contain paths built from the 'guid' parameter. An authenticated subscriber can read arbitrary files on the server, which may hold sensitive data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed","uploads-tainacan-dir-exists"],"how_to_check":"- Check whether the Tainacan plugin is installed and its version in the WordPress admin plugins list or `wp plugin get tainacan --field=version`\n- Check whether the `uploads/tainacan` directory is missing under `wp-content/uploads`, since the sources say this is required for exploitation","fix":"- Update the Tainacan plugin to a version later than `1.3.0` (the sources do not name the fixed version: unknown)\n- If no fixed version is available, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-16T06:17:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:58:02+00:00","updated_at":"2026-10-25T03:58:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:58:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Tainacan plugin to a version later than `1.3.0` (the sources do not name the fixed version: unknown)\n- If no fixed version is available, deactivate the plugin until it is patched","reach":"internet","title":"Tainacan WordPress plugin: directory traversal lets subscribers read server files","impact":"medium","summary":"The Tainacan plugin for WordPress up to and including 1.3.0 fails to contain paths built from the 'guid' parameter. An authenticated subscriber can read arbitrary files on the server, which may hold sensitive data.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads arbitrary server files, possibly including secrets and config","analyst_note":"Confirm the fixed version and whether the uploads/tainacan directory condition is the only precondition, using the NVD entry and the plugin changelog.","how_to_check":"- Check whether the Tainacan plugin is installed and its version in the WordPress admin plugins list or `wp plugin get tainacan --field=version`\n- Check whether the `uploads/tainacan` directory is missing under `wp-content/uploads`, since the sources say this is required for exploitation","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts","uploads-tainacan-dir-exists"],"who_is_affected":"Sites running the Tainacan plugin at version `1.3.0` or earlier where subscriber-level accounts exist. The sources say exploitation only works when the `uploads/tainacan` directory does not exist, so sites that have it may be less exposed, but this is not confirmed. Sites without Tainacan, or with no user registration, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":3407,"output_tokens":661,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93767':13A,16A '1.3.0':34B,76C 'access':93C 'arbitrari':49B,101C 'attack':88C 'authent':45B,87C 'base':136C 'built':39B 'caus':129C 'check':146C 'collaps':134C 'condit':128C 'contain':37B,108C,145C 'content':99C 'cve':11A,14A 'data':58B 'directori':4A,67C,119C 'empti':140C 'exist':122C 'exploit':114C 'fail':35B 'fals':133C 'file':10A,50B,102C 'guid':42B,79C 'hold':56B 'host':20B 'includ':33B,75C 'ineffect':147C 'inform':110C 'let':6A 'level':92C 'make':83C 'may':55B 'packag':17B 'paramet':43B,80C,81C 'path':38B,137C 'plugin':3A,24B,27B,61C 'possibl':85C 'read':8A,48B,97C 'realpath':130C 'render':143C 'return':132C 'self':19B 'self-host':18B 'sensit':57B,109C 'server':9A,53B,105C,125C 'string':141C 'subscrib':7A,46B,91C 'subscriber-level':90C 'tainacan':1A,26B,60C 'travers':5A,68C 'uploads/tainacan':118C 'version':71C 'via':77C 'vulner':65C,112C 'wordpress':2A,21B,23B,29B,63C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Tainacan plugin at version `1.3.0` or earlier where subscriber-level accounts exist. The sources say exploitation only works when the `uploads/tainacan` directory does not exist, so sites that have it may be less exposed, but this is not confirmed. Sites without Tainacan, or with no user registration, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93767","severity":null,"published_at":"2026-10-16T06:17:12+00:00","modified_at":"2026-10-16T16:22:43+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}