CVE-2026-93767: Tainacan WordPress Path Traversal Flaw

CVE-2026-93767 Overview

The Tainacan plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 1.3.0. The flaw resides in the guid parameter handled by the plugin's REST background processes controller. Authenticated users with subscriber-level access or higher can read arbitrary files on the server, potentially exposing credentials, configuration data, and other sensitive content. The vulnerability is only exploitable when the uploads/tainacan directory does not exist, because that condition causes realpath() to return false and collapses the containment check. This weakness is tracked under CWE-22.

Critical Impact
Authenticated subscribers can read arbitrary files on the host filesystem through the Tainacan REST API when the uploads directory is missing.

Affected Products

Tainacan plugin for WordPress — all versions up to and including 1.3.0
WordPress sites exposing the Tainacan REST API endpoints
Installations where the wp-content/uploads/tainacan directory does not exist

Discovery Timeline

2026-10-16 - CVE-2026-93767 published to the National Vulnerability Database
2026-10-16 - Entry last modified in NVD

Technical Details for CVE-2026-93767

Vulnerability Analysis

The Tainacan plugin exposes a REST endpoint controlled by class-tainacan-rest-background-processes-controller.php. The controller accepts a user-supplied guid parameter and uses it to build a file path intended to remain inside the wp-content/uploads/tainacan directory. The containment check relies on realpath() to canonicalize both the target path and the base directory before comparing their prefixes. When the base uploads/tainacan directory does not exist on disk, realpath() returns false, which PHP coerces to an empty string in the subsequent comparison. The containment check then succeeds against an empty prefix, allowing any traversed path to pass validation.

An attacker with at least subscriber privileges can supply a guid value containing ../ sequences to escape the intended directory and read arbitrary files readable by the web server user. Target files commonly include wp-config.php, shell history, SSH keys, and application logs.

Root Cause

The root cause is reliance on realpath() without validating its return value before using it in the prefix comparison. When realpath() fails because the base path is missing, the fallback behavior silently defeats the directory containment logic. Reference lines in the vulnerable controller include line 147, line 391, line 393, and line 418.

Attack Vector

Exploitation requires network access to the WordPress REST API and an authenticated account with subscriber-level privileges or higher. The attacker issues a request to the vulnerable Tainacan background-processes endpoint and supplies a guid value containing path traversal sequences. The server resolves the manipulated path, bypasses the broken containment check, and returns the contents of the requested file in the response. See the Wordfence vulnerability analysis for additional technical context.

Detection Methods for CVE-2026-93767

Indicators of Compromise

REST API requests to Tainacan background-process endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the guid parameter.
Access log entries from low-privilege authenticated users retrieving unexpected file contents from Tainacan endpoints.
Outbound responses containing fragments of wp-config.php, /etc/passwd, or private key material originating from Tainacan API responses.

Detection Strategies

Inspect WordPress and web server access logs for Tainacan REST routes invoked by subscriber-tier accounts.
Alert on any guid parameter value that contains traversal characters, absolute paths, or null bytes.
Correlate failed realpath() conditions by monitoring for a missing wp-content/uploads/tainacan directory on hosts running Tainacan 1.3.0 or earlier.

Monitoring Recommendations

Enable WordPress REST API request logging and forward it to a centralized SIEM for query and retention.
Monitor file access patterns for the web server user to detect reads of sensitive files such as wp-config.php or SSH keys.
Track plugin version inventory across WordPress estates to identify hosts still exposing vulnerable Tainacan builds.

How to Mitigate CVE-2026-93767

Immediate Actions Required

Update the Tainacan plugin to a version later than 1.3.0 that includes the fix from the upstream changeset.
Create the wp-content/uploads/tainacan directory with appropriate ownership and permissions so realpath() resolves successfully.
Review subscriber and contributor accounts for signs of abuse and rotate any credentials that may have been exposed through wp-config.php reads.

Patch Information

The Tainacan maintainers addressed the issue in the changeset referenced above. The fix validates the output of realpath() and enforces a correct prefix comparison before file contents are returned. Site operators should upgrade to the patched release and confirm the plugin version on each host.

Workarounds

Restrict access to the Tainacan REST API endpoints at the web server or WAF layer until the patch is applied.
Disable the Tainacan plugin on sites that do not require it, especially those that allow open subscriber registration.
Ensure the wp-content/uploads/tainacan directory exists on disk so the vulnerable realpath() branch is not triggered.

bash

# Create the expected uploads directory to neutralize the realpath() failure condition
sudo -u www-data mkdir -p /var/www/html/wp-content/uploads/tainacan
sudo chmod 750 /var/www/html/wp-content/uploads/tainacan

# Verify the installed Tainacan plugin version with WP-CLI
wp plugin get tainacan --field=version

# Update Tainacan to the patched release
wp plugin update tainacan