CVE-2026-94676: Tainacan Object Injection Vulnerability

CVE-2026-94676 Overview

CVE-2026-94676 is a PHP Object Injection vulnerability in the Tainacan WordPress plugin, a digital collection management plugin maintained by the Tainacan Community. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions of Tainacan up to and including 1.3.0. An attacker with high-privilege access on the target WordPress site can submit crafted serialized payloads that trigger object instantiation during unserialization. Depending on the gadget chains available in the plugin or other installed components, successful exploitation can lead to arbitrary code execution, file manipulation, or data compromise.

Critical Impact
Authenticated attackers can achieve full compromise of confidentiality, integrity, and availability on affected WordPress installations running Tainacan 1.3.0 or earlier.

Affected Products

Tainacan WordPress plugin (vendor: Tainacan Community)
All versions from n/a through 1.3.0
WordPress sites with the Tainacan plugin installed and activated

Discovery Timeline

2026-10-10 - CVE-2026-94676 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-94676

Vulnerability Analysis

The vulnerability resides in Tainacan's handling of serialized PHP data. The plugin passes attacker-controllable input to a PHP deserialization routine without validating or restricting the classes that may be instantiated. During deserialization, PHP automatically invokes magic methods such as __wakeup() and __destruct() on the resulting objects. When combined with suitable gadget chains in the plugin, WordPress core, or other active plugins, this behavior enables Object Injection and arbitrary code execution within the PHP runtime.

Because the vulnerable code path requires high privileges, the attacker must first authenticate with a privileged WordPress account. Once that condition is met, the request traverses the network attack surface with low complexity and no user interaction, making exploitation reliable against targeted sites.

Root Cause

The root cause is unsafe use of unserialize() on untrusted input, classified under [CWE-502] Deserialization of Untrusted Data. Tainacan accepts serialized payloads from an authenticated request path and deserializes them without an allowlist of expected classes or an integrity check such as a signed envelope.

Attack Vector

An authenticated attacker with elevated privileges submits a crafted serialized string to a vulnerable Tainacan endpoint. The payload references PHP classes whose magic methods perform sensitive operations such as file writes, SQL execution, or dynamic function calls. When PHP reconstructs the object graph, those methods fire and execute attacker-selected logic in the context of the web server process. No verified public proof-of-concept is available at this time. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-94676

Indicators of Compromise

Requests to Tainacan plugin endpoints containing serialized PHP markers such as O: or a: followed by class names and integer counts.
Unexpected PHP processes spawning shell commands, writing files to wp-content/uploads/, or modifying plugin and theme files.
New or modified administrator accounts, scheduled tasks (wp_cron), or options rows containing serialized payloads referencing unexpected classes.
Outbound network connections from the web server to attacker-controlled infrastructure immediately after authenticated Tainacan requests.

Detection Strategies

Inspect HTTP request bodies and query parameters sent to Tainacan routes for serialized PHP patterns originating from authenticated sessions.
Correlate privileged WordPress user activity with child process creation on the PHP-FPM or Apache worker processes.
Review WordPress audit logs for configuration changes performed by accounts that normally do not administer the Tainacan plugin.

Monitoring Recommendations

Enable verbose logging on the WordPress REST and admin-ajax endpoints exposed by Tainacan.
Forward web server, PHP, and WordPress logs to a centralized analytics backend for cross-source correlation.
Alert on file integrity changes within the Tainacan plugin directory and the broader wp-content/plugins/ tree.

How to Mitigate CVE-2026-94676

Immediate Actions Required

Identify every WordPress instance running the Tainacan plugin and confirm the installed version.
Restrict administrative and editor-level access to the WordPress site and rotate credentials for any privileged accounts.
Place the WordPress admin area behind an IP allowlist or VPN until a fixed version is deployed.
Review audit logs for suspicious activity performed by accounts with the privileges required to reach the vulnerable code path.

Patch Information

At the time of publication, the advisory lists affected versions through 1.3.0. Monitor the Patchstack WordPress Vulnerability Report and the Tainacan project repository for a security release that addresses the deserialization flaw. Upgrade immediately once a fixed version is published.

Workarounds

Deactivate and remove the Tainacan plugin on sites that do not require it until a patched release is available.
Deploy web application firewall rules that block requests containing serialized PHP object markers destined for Tainacan endpoints.
Harden the PHP runtime by disabling unnecessary classes and functions commonly used in deserialization gadget chains.
Enforce the principle of least privilege for WordPress roles so that fewer accounts can reach the vulnerable code path.

bash

# Example WAF rule concept to block serialized PHP objects in Tainacan requests
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-json/tainacan" \
  "id:1026094676,phase:2,deny,log,status:403,\
   msg:'Potential PHP Object Injection against Tainacan (CVE-2026-94676)',\
   chain"
  SecRule REQUEST_BODY|ARGS "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:\{" \
    "t:none"