CVE-2026-95590 Overview
CVE-2026-95590 is a SQL Injection vulnerability affecting the Tainacan WordPress plugin in versions up to and including 1.2.0. The flaw allows an authenticated user with Subscriber-level privileges to inject SQL statements through plugin input handling that fails to properly sanitize user-supplied data. Tainacan is a digital repository platform used by museums, archives, and libraries to manage collections through WordPress. Successful exploitation can expose database contents and impact the availability of the underlying site. The issue is tracked as CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated Subscribers can inject SQL queries against the WordPress database, leading to confidentiality loss and potential service disruption on sites running Tainacan <= 1.2.0.
Affected Products
- Tainacan WordPress plugin versions <= 1.2.0
- WordPress installations with the Tainacan plugin enabled
- Sites permitting Subscriber-level account registration
Discovery Timeline
- 2026-09-23 - CVE-2026-95590 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-95590
Vulnerability Analysis
The vulnerability resides in the Tainacan plugin's handling of user-controlled parameters that are passed into SQL queries without sufficient sanitization or parameterization. An attacker holding a Subscriber account, the lowest authenticated role in WordPress, can supply crafted input that alters the structure of backend SQL statements. Because Subscriber accounts are frequently permitted through open registration, the barrier to exploitation is low on affected sites.
The scope change indicated by the vulnerability metadata suggests injected SQL can affect resources beyond the plugin's own security context, reaching the broader WordPress database. Attackers can extract sensitive records such as user metadata, session tokens, or repository content managed by Tainacan.
Root Cause
The root cause is improper neutralization of special SQL characters in plugin request handlers. Tainacan <= 1.2.0 fails to consistently apply prepared statements or WordPress core sanitization helpers such as $wpdb->prepare() before executing queries containing user input. This omission allows attacker-controlled fragments to be concatenated into query strings.
Attack Vector
Exploitation requires network access to the target WordPress site and a valid Subscriber-level session. The attacker submits crafted parameters to a vulnerable Tainacan endpoint, embedding SQL operators or subqueries. Attack complexity is elevated because the attacker must identify and shape input that reaches the vulnerable query path, but no user interaction is required.
For technical specifics on the vulnerable code path and reproduction, refer to the Patchstack Vulnerability Report.
Detection Methods for CVE-2026-95590
Indicators of Compromise
- Unexpected SQL syntax fragments such as UNION SELECT, SLEEP(, or information_schema appearing in web server access logs targeting Tainacan endpoints.
- Anomalous database errors logged by WordPress or the plugin referencing malformed queries originating from authenticated Subscriber sessions.
- Newly registered Subscriber accounts followed by immediate, repeated requests to Tainacan REST or admin-ajax endpoints.
Detection Strategies
- Inspect HTTP request bodies and query strings for SQL metacharacters and boolean-based payloads targeting Tainacan paths.
- Correlate authentication events with database error spikes to surface injection attempts that trigger query failures.
- Baseline normal Tainacan API request volumes per user role and alert on outliers from Subscriber accounts.
Monitoring Recommendations
- Enable WordPress debug logging temporarily to capture $wpdb errors during triage.
- Forward web server, PHP, and MySQL logs to a centralized analytics platform for cross-source correlation.
- Monitor user role assignments and creation events for suspicious registration bursts preceding plugin activity.
How to Mitigate CVE-2026-95590
Immediate Actions Required
- Update the Tainacan plugin to a version above 1.2.0 that addresses CVE-2026-95590.
- Disable open user registration or restrict the default role to prevent unauthenticated attackers from obtaining Subscriber access.
- Audit existing Subscriber accounts for suspicious activity and remove any that were not legitimately provisioned.
Patch Information
Review the Patchstack Vulnerability Report for the fixed version and vendor guidance. Apply the plugin update through the WordPress admin dashboard or via WP-CLI during a scheduled maintenance window.
Workarounds
- Deploy a web application firewall rule to block SQL keywords in requests targeting Tainacan endpoints until patching is complete.
- Temporarily deactivate the Tainacan plugin on sites that cannot be updated immediately.
- Enforce least-privilege database credentials for the WordPress wp-config.php connection to limit blast radius from injection.
# Configuration example: update Tainacan via WP-CLI and disable open registration
wp plugin update tainacan
wp option update users_can_register 0
wp option update default_role subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
