Executive brief
Tainacan is a WordPress plugin used for managing and displaying digital collections. A security flaw in the plugin allows unauthorized individuals to perform database queries that could lead to the theft of sensitive information. This occurs because the plugin does not properly verify certain location-based search requests, potentially compromising customer data or site configuration details.
Technical details
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection due to improper neutralization of special elements in the 'geoquery' parameter. Specifically, the 'class-tainacan-geocoordinate-helper.php' component fails to sufficiently escape user-supplied input and lacks proper SQL query preparation. An unauthenticated attacker can exploit this by sending crafted network requests to append malicious SQL commands to existing queries. This allows for the exfiltration of sensitive data from the WordPress database based on the time delay of the server's response. A fix has been committed to the GitHub repository.
Affected products
- Tainacan Tainacan up to and including 1.0.3
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory