CVE-2026-90989 Tainacan CVE debrief

Who should care

Defenders responsible for managing WordPress installations with the Tainacan plugin should assess exposure and prioritize updating to version 1.4.0 or later to prevent unauthorized access to repository staff email addresses.

Why it matters

The Tainacan plugin vulnerability allows authenticated subscribers to access repository staff email addresses, potentially leading to unauthorized access, phishing attacks, or data breaches. Defenders should prioritize verifying the plugin version and updating to 1.4.0 or later.

• Potential unauthorized access to repository staff email addresses
• Increased risk of phishing or social engineering attacks
• Potential data breaches or unauthorized data disclosure
• Need for verification of Tainacan plugin version and remediation

Technical summary

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff. This vulnerability is caused by inadequate access controls on the reports REST endpoints. Defenders should verify the plugin version and update to 1.4.0 or later to prevent unauthorized access to repository staff email addresses. The vulnerability allows authenticated subscribers to access sensitive information, potentially leading to unauthorized

Defensive priority

Defenders should prioritize verifying the version of the Tainacan plugin in use and ensuring that it is updated to 1.4.0 or later to prevent unauthorized access to repository staff email addresses.

Recommended defensive actions

• Verify the version of the Tainacan plugin in use and update to 1.4.0 or later
• Restrict access to reports REST endpoints to users with management capabilities
• Monitor for unauthorized access to repository staff email addresses

Evidence notes

The CVE record and source item provide limited information about the vulnerability, but indicate that the Tainacan plugin does not restrict access to its reports REST endpoints, allowing authenticated subscribers to access repository staff email addresses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.