CVE-2025-12747: Tainacan Information Disclosure Flaw

CVE-2025-12747 Overview

CVE-2025-12747 is an Information Exposure vulnerability [CWE-552] affecting the Tainacan plugin for WordPress in all versions up to and including 1.0.0. Files uploaded and marked as private are stored in the wp-content directory without adequate access protection. Unauthenticated attackers can access these files directly over the network by requesting their URLs. The flaw allows extraction of potentially sensitive information from resources the site owner intended to restrict. The Tainacan project addressed the issue in version 1.0.1.

Critical Impact
Unauthenticated remote attackers can retrieve files marked as private, breaking the confidentiality guarantees advertised by the plugin's privacy setting.

Affected Products

Tainacan plugin for WordPress, versions up to and including 1.0.0
WordPress installations using Tainacan private file uploads
Sites relying on the plugin's wp-content file protection for private assets

Discovery Timeline

2025-11-21 - CVE-2025-12747 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12747

Vulnerability Analysis

The Tainacan plugin allows users to upload files and flag them as private. The plugin stores these files inside the WordPress wp-content directory, which is served directly by the web server. Because the storage location remains web-accessible and the plugin does not enforce an authorization check on file requests, anyone who knows or guesses the URL can retrieve the content. The vulnerability is an instance of Files or Directories Accessible to External Parties [CWE-552] and results in confidentiality loss without impacting integrity or availability. Exploitation requires no authentication, no user interaction, and no elevated privileges.

Root Cause

The root cause is a design gap in how the plugin enforces file privacy. Marking a file as private updates plugin metadata but does not move the file outside the web root or install a request-time access control layer such as a signed URL or PHP handler that validates the caller. The relevant logic resides in class-tainacan-private-files.php, which failed to gate access to files it stored in wp-content.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to the direct URL of a file stored under wp-content by the plugin. Because the web server delivers the file without invoking the plugin's authorization logic, the response contains the file contents even when the plugin's user interface labels the item as private. Attackers can enumerate predictable file paths, harvest URLs referenced elsewhere on the site, or use search engine indexes to identify targets.

No verified exploitation code is publicly available. See the Wordfence Vulnerability Analysis and the Tainacan private files class source for the vulnerable component.

Detection Methods for CVE-2025-12747

Indicators of Compromise

Access log entries showing unauthenticated GET requests to files under wp-content associated with Tainacan uploads
High-volume directory enumeration or scanner traffic against Tainacan upload paths
Requests to file paths that match items flagged as private in the Tainacan database

Detection Strategies

Review WordPress wp-content access logs for external IPs retrieving files that correspond to private Tainacan items
Cross-reference the plugin's private-file metadata against web server logs to identify successful unauthorized retrievals
Deploy WordPress security plugins or web application firewall rules that block direct access to Tainacan private file paths

Monitoring Recommendations

Alert on repeated 200-status responses from unauthenticated clients targeting Tainacan storage directories
Monitor for search engine crawlers indexing private file URLs and issue removal requests where needed
Track plugin version inventory across managed WordPress sites to flag installations at or below version 1.0.0

How to Mitigate CVE-2025-12747

Immediate Actions Required

Update the Tainacan plugin to version 1.0.1 or later, which contains the vendor fix
Audit files previously marked as private to determine if any were accessed by unauthorized parties
Rotate, redact, or remove any sensitive data that was exposed while the plugin was vulnerable

Patch Information

The Tainacan maintainers released version 1.0.1 to address the issue. Review the Tainacan 1.0.0 to 1.0.1 diff for the exact code changes applied to the private file handling logic.

Workarounds

Restrict direct access to the plugin's private upload directory using web server rules in .htaccess or the Nginx configuration until patching completes
Move private files to a location outside the web root and serve them through an authenticated PHP handler
Apply a web application firewall rule that blocks unauthenticated requests to Tainacan private file paths

bash

# Apache example: deny direct access to Tainacan private uploads
<Directory "/var/www/html/wp-content/uploads/tainacan-private">
    Require all denied
</Directory>