CVE-2026-6230: Tainacan WordPress Plugin SQL Injection Flaw

CVE-2026-6230 Overview

CVE-2026-6230 is a time-based blind SQL Injection vulnerability in the Tainacan plugin for WordPress. The flaw affects all versions up to and including 1.0.3. It exists in the handling of the geoquery parameter, where insufficient escaping and inadequate query preparation allow attackers to append arbitrary SQL to existing database queries.

Unauthenticated attackers can exploit this issue over the network without user interaction. Successful exploitation enables extraction of sensitive database contents, including credentials, user records, and configuration data stored in the WordPress database [CWE-89].

Critical Impact
Unauthenticated attackers can extract arbitrary data from the WordPress database through time-based blind SQL injection against the geoquery parameter.

Affected Products

Tainacan plugin for WordPress, all versions up to and including 1.0.3
WordPress sites using the Tainacan geocoordinate metadata feature
Public-facing WordPress deployments exposing Tainacan query endpoints

Discovery Timeline

2026-07-08 - CVE-2026-6230 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-6230

Vulnerability Analysis

The Tainacan plugin implements a geographic query feature through the posts_where filter in class-tainacan-geocoordinate-helper.php. This filter injects SQL fragments into the WordPress WHERE clause when the request includes a geoquery parameter. The vulnerable code path processed values from $wp_query->query['geoquery'] without escaping user input or preparing the SQL statement using $wpdb->prepare().

Because the parameter reaches the SQL layer as raw string data, attackers can break out of the intended query structure. The vulnerability is time-based blind, meaning attackers infer data by observing response delays produced through payloads such as SLEEP() or conditional timing functions. This class of flaw does not require authentication and is exploitable directly against any endpoint that triggers a Tainacan geoquery.

Root Cause

The root cause is missing input sanitization combined with the absence of parameterized queries. The plugin concatenated geoquery values directly into the SQL fragment appended to the WordPress query. Neither esc_sql() nor $wpdb->prepare() was applied before the string reached the database driver.

Attack Vector

An unauthenticated remote attacker submits a crafted HTTP request containing a malicious geoquery parameter. The plugin passes the parameter into the constructed WHERE clause. The attacker uses timing-based payloads to extract data one bit at a time from the underlying MySQL or MariaDB database.

php

// Security patch from Tainacan commit 579d28d
// File: class-tainacan-geocoordinate-helper.php
 public function posts_where($where, $wp_query) {
+    global $wpdb;
     $args = $wp_query->query;
 
     if ($this::$filter_where || !isset($args['geoquery'])) {
// Source: https://github.com/tainacan/tainacan/commit/579d28d7752b27ed3407f5197abb6349b3efc3c9

The patch introduces the $wpdb global so that subsequent query construction can use prepared statements rather than raw string concatenation.

Detection Methods for CVE-2026-6230

Indicators of Compromise

HTTP requests containing the geoquery parameter with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or AND 1=1
Abnormally long response times on WordPress endpoints when the geoquery parameter is present
Repeated requests from a single source iterating character positions or ASCII values in the geoquery value
Unexpected outbound queries or high database CPU usage originating from WordPress worker processes

Detection Strategies

Inspect web server access logs for requests containing geoquery= with URL-encoded SQL syntax or comment sequences (--, /*, %23)
Deploy web application firewall rules that flag SQL metacharacters and timing functions in query parameters targeting Tainacan endpoints
Correlate slow query logs from MySQL or MariaDB with matching WordPress requests to identify blind extraction attempts

Monitoring Recommendations

Enable verbose logging on the WordPress application and reverse proxy layer to capture full query strings
Monitor request latency distributions for Tainacan endpoints and alert on sustained outliers
Track failed and successful requests referencing geoquery and baseline against expected legitimate traffic

How to Mitigate CVE-2026-6230

Immediate Actions Required

Upgrade Tainacan to a version later than 1.0.3 that incorporates the fix from commit 579d28d7752b27ed3407f5197abb6349b3efc3c9
Restrict access to Tainacan endpoints behind authentication or IP allowlists until the plugin is patched
Review database and WordPress logs for prior exploitation attempts targeting the geoquery parameter

Patch Information

The vendor fix is available in the Tainacan GitHub commit 579d28d. Additional detail is available in the Wordfence Vulnerability Report. Site administrators should update through the WordPress plugin manager or by deploying the patched source directly.

Workarounds

Deploy a web application firewall rule that blocks requests containing the geoquery parameter until the plugin is updated
Temporarily deactivate the Tainacan plugin on production sites that cannot immediately apply the patch
Enforce least-privilege database accounts for WordPress so that a successful injection cannot access data outside the WordPress schema

bash

# Example ModSecurity rule to block suspicious geoquery values
SecRule ARGS:geoquery "@rx (?i)(sleep\(|benchmark\(|union\s+select|--|/\*)" \
    "id:1026230,phase:2,deny,status:403,\
    msg:'CVE-2026-6230 Tainacan geoquery SQLi attempt'"