Is CVE-2026-104743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104743 being exploited in the wild.

How severe is CVE-2026-104743?

Medium severity, with a CVSS score of 4.9, published 28 October 2026.

Which products and versions are affected?

Tainacan up to and including 1.3.0.

Is there a fix for CVE-2026-104743?

Yes: fixed in 1.3.1 (fix committed 2026-10-02). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104743 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104743?

Check whether you run Tainacan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104743: Tainacan directory traversal in importer tmp_file parameter

CVE-2026-104743 · Severity: medium · CVSS 4.9 · Published 2026-10-28

Tainacan is a WordPress plugin for managing and displaying digital collections. The vulnerability allows authenticated editors and administrators to read arbitrary files from the server through a directory traversal flaw in the file import feature, potentially exposing sensitive configuration files or database credentials. An attacker must have editor-level access or higher to exploit this issue.

Technologies: Tainacan. Vendors: Tainacan.

Quick answers

Is CVE-2026-104743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104743 being exploited in the wild.
How severe is CVE-2026-104743?: Medium severity, with a CVSS score of 4.9, published 28 October 2026.
Which products and versions are affected?: Tainacan up to and including 1.3.0.
Is there a fix for CVE-2026-104743?: Yes: fixed in 1.3.1 (fix committed 2026-10-02). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104743 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104743?: Check whether you run Tainacan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.3.1 (fix committed 2026-10-02)

Technical details

The plugin fails to properly validate the 'tmp_file' parameter in the importer endpoint, allowing authenticated users to traverse directories and specify arbitrary file paths. The malicious path is stored in the database and later retrieved via a GET request to the /source_info endpoint, where it is passed unsanitized to fopen() and fgetcsv() functions, returning parsed file contents in the REST API response. This is a path traversal (directory traversal) vulnerability requiring authentication and elevated privileges.

Affected products

Tainacan Tainacan up to and including 1.3.0

Timeline

2026-10-28: disclosed
2026-10-02: other: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.