CVE-2026-93767 tainacan CVE debrief

Who should care

WordPress site administrators, security teams, and users of the Tainacan plugin should assess their exposure and take necessary actions to mitigate the vulnerability. This includes verifying the existence of the uploads/tainacan directory, reviewing file permissions, and applying patches or updates as available. Security teams should prioritize this medium-severity vulnerability and coordinate with operators to ensure timely remediation.

Why it matters

CVE-2026-93767 is a medium-severity vulnerability in the Tainacan WordPress plugin that allows authenticated attackers to read arbitrary files. WordPress administrators and security teams should assess exposure and apply necessary patches or mitigations.

• Potential unauthorized access to sensitive files.
• Possible exposure of confidential data.
• Need for verification of uploads/tainacan directory existence.
• Requirement for patching or mitigating the vulnerability.

Technical summary

The Tainacan plugin for WordPress is vulnerable to Directory Traversal due to inadequate handling of the 'guid' parameter. This allows authenticated attackers with subscriber-level access to read arbitrary files on the server, potentially exposing sensitive information. The vulnerability exists in all versions up to and including 1.3.0 and is contingent on the uploads/tainacan directory not existing on the server.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess if the Tainacan plugin version 1.3.0 or earlier is installed and in use.
• Verify if the uploads/tainacan directory exists on the server.
• Apply updates or patches for the Tainacan plugin if available.
• Restrict access to sensitive files and directories.
• Monitor for suspicious file access attempts.

Evidence notes

The vulnerability is confirmed in Tainacan plugin versions up to 1.3.0. The exploit is contingent on the absence of the uploads/tainacan directory. Official CVE and NVD records provide details. To verify, defenders should check for the existence of the uploads/tainacan directory and review file access controls. This vulnerability allows authenticated attackers with subscriber-level access to read arbitrary files, potentially exposing sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.