Directory Traversal Vulnerability in Tainacan Plugin for WordPress

CVE-2026-104743

What is CVE-2026-104743?

The Tainacan plugin for WordPress is affected by a directory traversal vulnerability found in versions up to and including 1.3.0. This issue arises from improper handling of the 'tmp_file' parameter, which allows authenticated users with editor-level access or higher to potentially read any file on the server. By manipulating the input, an attacker can craft requests that lead to unintended file exposures. The maliciously crafted importer path gets stored in the database and can be executed later, revealing sensitive information through parsed responses in REST API calls. It's crucial for users to update to a secure version to mitigate risks.

References