CVE-2026-6230

Name of the Vulnerable Software and Affected Versions Tainacan versions prior to 1.0.4

Description The Tainacan plugin for WordPress contains a time-based blind SQL Injection flaw. This occurs because the software does not sufficiently escape user-supplied input or properly prepare the SQL query. Unauthenticated attackers can exploit this by appending malicious SQL queries to existing ones via the geoquery parameter in the REST API to extract sensitive information from the database. Time-based blind SQL Injection is a technique where an attacker asks the database true/false questions and determines the answer based on the time the server takes to respond.

Recommendations Update Tainacan to version 1.0.4 or later. As a temporary mitigation, restrict access to the geoquery parameter in the REST API.