CVE-2026-90989: Tainacan WordPress Information Disclosure

CVE-2026-90989 Overview

CVE-2026-90989 affects the Tainacan WordPress plugin in versions prior to 1.4.0. The plugin fails to restrict its reports REST API endpoints to users holding a management capability. Any authenticated subscriber can query these endpoints and retrieve the email addresses of the repository's staff. The flaw is a broken access control issue in the REST route authorization layer. Attackers who register low-privilege accounts can harvest staff email addresses for phishing, credential stuffing, or social engineering campaigns targeting the WordPress site's administrators and contributors.

Critical Impact
Authenticated subscribers can enumerate staff email addresses via unprotected REST endpoints, enabling targeted phishing against repository administrators.

Affected Products

Tainacan WordPress plugin versions prior to 1.4.0
WordPress sites that permit subscriber-level registration with the plugin installed
Digital repository installations exposing Tainacan reports endpoints

Discovery Timeline

2026-10-14 - CVE CVE-2026-90989 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-90989

Vulnerability Analysis

Tainacan is a WordPress plugin that provides digital repository and collection management functionality. The plugin exposes a set of REST API endpoints under its reports namespace. These endpoints return aggregated information about the repository, including administrative metadata such as the email addresses of staff users.

The reports endpoints lack a proper permission_callback that enforces a management-level capability. As a result, the WordPress REST API only verifies that the caller is authenticated, not that the caller holds manage_options or an equivalent repository management role. Any user with a valid session, including the lowest-privilege subscriber role, can call the endpoints and receive staff email data in the response.

The disclosed data enables downstream attacks. Staff email addresses are high-value inputs for spear phishing, password reset abuse, and account takeover attempts against users who hold administrative WordPress capabilities.

Root Cause

The root cause is missing authorization on REST route registration. The reports controller does not restrict access to users with a management capability, treating any authenticated request as valid. This is a Broken Access Control defect [CWE-284] combined with information exposure [CWE-200].

Attack Vector

An attacker registers or compromises a subscriber account on a WordPress site running a vulnerable Tainacan version. The attacker then issues authenticated HTTP requests to the plugin's reports REST endpoints. The server returns staff email addresses that should be restricted to administrators. No elevation of privilege, exploit chain, or crafted payload is required. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-90989

Indicators of Compromise

Requests from subscriber-level accounts to REST paths under /wp-json/tainacan/ targeting reports endpoints
Unexpected spikes in authenticated REST API calls from newly registered low-privilege accounts
Phishing emails to staff addresses that were never published publicly

Detection Strategies

Review WordPress access logs for authenticated REST calls to Tainacan reports routes originating from non-administrative user IDs
Correlate new subscriber registrations with subsequent REST API activity against plugin endpoints
Audit the Tainacan plugin version across all WordPress deployments and flag versions below 1.4.0

Monitoring Recommendations

Enable WordPress REST API request logging and forward it to a centralized log store
Alert on any single authenticated account issuing high volumes of /wp-json/tainacan/ requests within a short window
Monitor for outbound phishing campaigns referencing internal staff identities as a lagging indicator of harvested data

How to Mitigate CVE-2026-90989

Immediate Actions Required

Upgrade the Tainacan WordPress plugin to version 1.4.0 or later on all affected sites
Audit existing subscriber accounts and remove unused or suspicious registrations
Rotate credentials for administrators whose email addresses may have been exposed

Patch Information

The vendor fixed the authorization check in Tainacan 1.4.0. The patched version enforces a management capability on the reports REST endpoints, blocking subscriber access. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open user registration in WordPress until the plugin is updated by setting Anyone can register to off under Settings > General
Restrict access to /wp-json/tainacan/ paths at the web server or WAF layer to known administrative IP ranges
Temporarily deactivate the Tainacan plugin on public-facing sites if an immediate upgrade is not possible

bash

# Configuration example: block REST access to Tainacan reports at the Nginx layer
location ~ ^/wp-json/tainacan/.*/reports {
    allow 10.0.0.0/8;
    deny all;
}